iatoolkit 2.18.6__tar.gz → 2.19.0__tar.gz

{iatoolkit-2.18.6/src/iatoolkit.egg-info → iatoolkit-2.19.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iatoolkit
-Version: 2.18.6
+Version: 2.19.0
 Summary: IAToolkit
 Author: Fernando Libedinsky
 License-Expression: MIT

{iatoolkit-2.18.6 → iatoolkit-2.19.0}/src/iatoolkit/__init__.py

@@ -3,7 +3,7 @@
 #
 # IAToolkit is open source software.
 
-__version__ = "2.18.6"
+__version__ = "2.19.0"
 
 # Expose main classes and functions at the top level of the package
 

{iatoolkit-2.18.6 → iatoolkit-2.19.0}/src/iatoolkit/locales/en.yaml

@@ -1741,6 +1741,14 @@ ui:
     custom_resources_toggle: "Use manual visibility"
     custom_resources_help: "If this is disabled, MCP resources are enabled automatically based on the published catalog."
     context_resources_help: "MCP resources are client-readable context or discovery; SQL sources and collections are managed under Data sources."
+    company_context_title: "Company context"
+    company_context_help: "Control which markdown files are concatenated to build get_company_context."
+    company_context_preview_title: "Company context preview"
+    custom_company_context_toggle: "Use manual selection"
+    company_context_auto_help: "Automatic mode includes every context markdown file available for this tenant."
+    company_context_custom_help: "Select the markdown files that should be concatenated into get_company_context."
+    company_context_empty: "No context markdown files are available."
+    company_context_empty_preview: "No company context was generated."
     validation_title: "Validation"
     validation_help: "Review publication gaps before exposing this tenant through MCP."
     access_oauth_title: "OAuth first, tokens as an advanced option"

{iatoolkit-2.18.6 → iatoolkit-2.19.0}/src/iatoolkit/locales/es.yaml

@@ -1745,6 +1745,14 @@ ui:
     custom_resources_toggle: "Usar visibilidad manual"
     custom_resources_help: "Si no activas esta opción, las resources MCP se habilitan automáticamente según el catálogo publicado."
     context_resources_help: "Los resources MCP son contexto o discovery legible por el cliente; las fuentes SQL y colecciones se administran en Fuentes de datos."
+    company_context_title: "Contexto empresa"
+    company_context_help: "Controla qué archivos markdown se concatenan para construir get_company_context."
+    company_context_preview_title: "Vista previa del contexto empresa"
+    custom_company_context_toggle: "Usar selección manual"
+    company_context_auto_help: "El modo automático incluye todos los archivos markdown de contexto disponibles para este tenant."
+    company_context_custom_help: "Selecciona los archivos markdown que se concatenarán en get_company_context."
+    company_context_empty: "No hay archivos markdown de contexto disponibles."
+    company_context_empty_preview: "No se generó contexto empresa."
     validation_title: "Validación"
     validation_help: "Revisa brechas de publicación antes de exponer este tenant por MCP."
     access_oauth_title: "OAuth primero, tokens como opción avanzada"

{iatoolkit-2.18.6 → iatoolkit-2.19.0}/src/iatoolkit/repositories/database_manager.py

@@ -19,6 +19,7 @@ class DatabaseManager(DatabaseProvider):
     _POSTGRES_BOOTSTRAP_PATCHES = (
     )
     _DEFAULT_CONNECT_TIMEOUT = 60
+    MAX_RESULT_ROWS = 1000
 
     @inject
     def __init__(self,
@@ -42,6 +43,7 @@ class DatabaseManager(DatabaseProvider):
 
         self.url = make_url(database_url)
         self.backend = self.url.get_backend_name()
+        self.statement_timeout_seconds = self._resolve_statement_timeout(timeout)
         if self._is_redshift():
             self._ensure_redshift_dialect_registered()
         self.engine_url = self._build_engine_url()
@@ -114,6 +116,13 @@ class DatabaseManager(DatabaseProvider):
 
         return self.timeout
 
+    def _resolve_statement_timeout(self, timeout: int | str | None) -> int | None:
+        explicit_timeout = timeout is not None
+        url_timeout_present = any(self.url.query.get(key) is not None for key in ("timeout", "connect_timeout"))
+        if not explicit_timeout and not url_timeout_present:
+            return None
+        return self._resolve_timeout()
+
     def _build_engine_url(self):
         normalized_url = self.url
         if self._is_redshift():
@@ -216,6 +225,15 @@ class DatabaseManager(DatabaseProvider):
     def get_dialect(self) -> str:
         return str(self.backend or "").strip().lower()
 
+    def _apply_statement_timeout(self, session) -> None:
+        if not self._is_postgres():
+            return
+        if self.statement_timeout_seconds is None:
+            return
+
+        timeout_ms = max(int(self.statement_timeout_seconds * 1000), 1)
+        session.execute(text(f"SET LOCAL statement_timeout = {timeout_ms}"))
+
     def create_all(self):
         # if there is a schema defined, make sure it exists before creating tables
         if self.schema and self._is_postgres():
@@ -264,6 +282,7 @@ class DatabaseManager(DatabaseProvider):
             normalized_schema = str(self.schema or "").strip()
             if normalized_schema and normalized_schema.lower() != "public":
                 session.execute(text(f"SET search_path TO {normalized_schema}, public"))
+        self._apply_statement_timeout(session)
 
         result = session.execute(text(query), params or {})
         if commit:
@@ -272,7 +291,12 @@ class DatabaseManager(DatabaseProvider):
         if result.returns_rows:
             # Convert SQLAlchemy rows to list of dicts immediately
             cols = result.keys()
-            return [dict(zip(cols, row)) for row in result.fetchall()]
+            rows = result.fetchmany(self.MAX_RESULT_ROWS + 1)
+            if len(rows) > self.MAX_RESULT_ROWS:
+                raise ValueError(
+                    f"Query returned more than {self.MAX_RESULT_ROWS} rows. Refine the query with filters or LIMIT."
+                )
+            return [dict(zip(cols, row)) for row in rows]
 
         return {'rowcount': result.rowcount}
 

{iatoolkit-2.18.6 → iatoolkit-2.19.0}/src/iatoolkit/services/company_context_service.py

@@ -30,8 +30,11 @@ class CompanyContextService:
         self.sql_source_service = sql_source_service
         self.asset_repo = asset_repo
 
-    def get_company_context(self, company_short_name: str) -> str:
-        blocks = self.get_company_context_blocks(company_short_name)
+    def get_company_context(self, company_short_name: str, *, selected_context_files: List[str] | None = None) -> str:
+        blocks = self.get_company_context_blocks(
+            company_short_name,
+            selected_context_files=selected_context_files,
+        )
         return "\n\n---\n\n".join(
             section
             for section in (
@@ -42,7 +45,13 @@ class CompanyContextService:
             if section
         )
 
-    def get_company_context_blocks(self, company_short_name: str, *, include_sql_context: bool = True) -> dict[str, str]:
+    def get_company_context_blocks(
+        self,
+        company_short_name: str,
+        *,
+        include_sql_context: bool = True,
+        selected_context_files: List[str] | None = None,
+    ) -> dict[str, str]:
         """
         Builds the full context by aggregating three sources:
         1. Static context files (Markdown).
@@ -57,7 +66,10 @@ class CompanyContextService:
 
         # 1. Context from Markdown (context/*.md)  files
         try:
-            md_context = self._get_static_file_context(company_short_name).strip()
+            md_context = self._get_static_file_context(
+                company_short_name,
+                selected_filenames=selected_context_files,
+            ).strip()
         except Exception as e:
             logging.warning(f"Could not load Markdown context for '{company_short_name}': {e}")
 
@@ -89,6 +101,38 @@ class CompanyContextService:
             "yaml_context": yaml_context,
         }
 
+    def list_context_files(self, company_short_name: str) -> list[dict]:
+        files = []
+        for filename in self._list_context_markdown_filenames(company_short_name):
+            title = ""
+            preview = ""
+            try:
+                content = self.asset_repo.read_text(company_short_name, AssetType.CONTEXT, filename)
+            except Exception as e:
+                logging.warning(f"Error reading context file {filename}: {e}")
+                content = ""
+
+            for raw_line in str(content or "").splitlines():
+                line = raw_line.strip()
+                if not line:
+                    continue
+                if not title and line.startswith("#"):
+                    title = line.lstrip("#").strip()
+                    continue
+                if not preview:
+                    preview = line
+                if title and preview:
+                    break
+
+            files.append(
+                {
+                    "filename": filename,
+                    "title": title or filename,
+                    "preview": preview,
+                }
+            )
+        return files
+
     def get_sql_context(self, company_short_name: str, allowed_databases: List[str] | None = None) -> str:
         try:
             sql_context, _ = self._get_sql_enriched_context(
@@ -370,16 +414,15 @@ class CompanyContextService:
         return "\n".join(output)
 
 
-    def _get_static_file_context(self, company_short_name: str) -> str:
+    def _get_static_file_context(self, company_short_name: str, *, selected_filenames: List[str] | None = None) -> str:
         # Get context from .md files using the repository
         static_context = ''
 
         try:
-            # 1. List markdown files in the context "folder"
-            # Note: The repo handles where this folder actually is (FS or DB)
-            md_files = self.asset_repo.list_files(company_short_name, AssetType.CONTEXT, extension='.md')
-
-            for filename in md_files:
+            for filename in self._resolve_context_filenames(
+                company_short_name,
+                selected_filenames=selected_filenames,
+            ):
                 try:
                     # 2. Read content
                     content = self.asset_repo.read_text(company_short_name, AssetType.CONTEXT, filename)
@@ -393,6 +436,37 @@ class CompanyContextService:
 
         return static_context
 
+    def _list_context_markdown_filenames(self, company_short_name: str) -> list[str]:
+        try:
+            md_files = self.asset_repo.list_files(company_short_name, AssetType.CONTEXT, extension='.md')
+        except Exception as e:
+            logging.warning(f"Error listing context files for {company_short_name}: {e}")
+            return []
+        normalized_files = []
+        for filename in md_files or []:
+            value = str(filename or "").strip()
+            if value and value not in normalized_files:
+                normalized_files.append(value)
+        return sorted(normalized_files)
+
+    def _resolve_context_filenames(
+        self,
+        company_short_name: str,
+        *,
+        selected_filenames: List[str] | None = None,
+    ) -> list[str]:
+        available_files = self._list_context_markdown_filenames(company_short_name)
+        if selected_filenames is None:
+            return available_files
+
+        allowed_files = set(available_files)
+        ordered_selection = []
+        for filename in selected_filenames or []:
+            value = str(filename or "").strip()
+            if value and value in allowed_files and value not in ordered_selection:
+                ordered_selection.append(value)
+        return ordered_selection
+
     @staticmethod
     def _normalize_identifier(value: str) -> str:
         if value is None:

{iatoolkit-2.18.6 → iatoolkit-2.19.0}/src/iatoolkit/services/sql_service.py

@@ -12,6 +12,7 @@ from injector import inject, singleton
 from typing import Callable
 import json
 import logging
+import re
 
 
 @singleton
@@ -20,6 +21,20 @@ class SqlService:
     Manages database connections and executes SQL statements.
     It maintains a cache of named DatabaseManager instances to avoid reconnecting.
     """
+    MAX_QUERY_ROWS = 1000
+    _ALLOWED_QUERY_PREFIXES = ("SELECT", "WITH")
+    _BLOCKED_SQL_PATTERN = re.compile(
+        r"\b(?:INSERT|UPDATE|DELETE|DROP|ALTER|CREATE|TRUNCATE|MERGE|CALL|COPY|GRANT|REVOKE|"
+        r"BEGIN|COMMIT|ROLLBACK|SAVEPOINT|RELEASE|VACUUM|ANALYZE|CLUSTER|REFRESH|"
+        r"EXEC(?:UTE)?|DO|SET|RESET|USE|PRAGMA|ATTACH|DETACH|REINDEX|LOCK|UNLOCK|INTO)\b",
+        re.IGNORECASE,
+    )
+    _SINGLE_QUOTED_LITERAL_RE = re.compile(r"'(?:''|[^'])*'")
+    _DOUBLE_QUOTED_LITERAL_RE = re.compile(r'"(?:""|[^"])*"')
+    _BACKTICK_LITERAL_RE = re.compile(r"`[^`]*`")
+    _BRACKET_LITERAL_RE = re.compile(r"\[[^\]]*\]")
+    _BLOCK_COMMENT_RE = re.compile(r"/\*.*?\*/", re.DOTALL)
+    _LINE_COMMENT_RE = re.compile(r"--[^\r\n]*")
 
     @inject
     def __init__(self,
@@ -155,6 +170,86 @@ class SqlService:
                 f"Database '{db_name}' is not registered for this company."
             )
 
+    @classmethod
+    def _sanitize_sql_for_validation(cls, query: str) -> str:
+        sanitized = str(query or "")
+        for pattern in (
+            cls._SINGLE_QUOTED_LITERAL_RE,
+            cls._DOUBLE_QUOTED_LITERAL_RE,
+            cls._BACKTICK_LITERAL_RE,
+            cls._BRACKET_LITERAL_RE,
+        ):
+            sanitized = pattern.sub(" ", sanitized)
+        sanitized = cls._BLOCK_COMMENT_RE.sub("", sanitized)
+        sanitized = cls._LINE_COMMENT_RE.sub("", sanitized)
+        return re.sub(r"\s+", " ", sanitized).strip()
+
+    def _assert_read_only_query(self, query: str) -> str:
+        normalized_query = str(query or "").strip()
+        if not normalized_query:
+            raise IAToolkitException(
+                IAToolkitException.ErrorType.DATABASE_ERROR,
+                "SQL query is required.",
+            )
+
+        sanitized = self._sanitize_sql_for_validation(normalized_query)
+        if not sanitized:
+            raise IAToolkitException(
+                IAToolkitException.ErrorType.DATABASE_ERROR,
+                "SQL query is required.",
+            )
+        if ";" in sanitized:
+            raise IAToolkitException(
+                IAToolkitException.ErrorType.DATABASE_ERROR,
+                "Only a single read-only SQL statement is allowed.",
+            )
+
+        upper_sanitized = sanitized.upper()
+        blocked_match = self._BLOCKED_SQL_PATTERN.search(upper_sanitized)
+        if blocked_match:
+            blocked_keyword = blocked_match.group(0).upper()
+            raise IAToolkitException(
+                IAToolkitException.ErrorType.DATABASE_ERROR,
+                f"Blocked SQL keyword detected: {blocked_keyword}.",
+            )
+
+        if not upper_sanitized.startswith(self._ALLOWED_QUERY_PREFIXES):
+            raise IAToolkitException(
+                IAToolkitException.ErrorType.DATABASE_ERROR,
+                "Only read-only SELECT statements are allowed.",
+            )
+        if upper_sanitized.startswith("WITH") and not re.search(r"\bSELECT\b", upper_sanitized):
+            raise IAToolkitException(
+                IAToolkitException.ErrorType.DATABASE_ERROR,
+                "WITH queries must resolve to a read-only SELECT statement.",
+            )
+
+        return normalized_query
+
+    def _enforce_result_row_limit(self, result_data):
+        if isinstance(result_data, list) and len(result_data) > self.MAX_QUERY_ROWS:
+            raise IAToolkitException(
+                IAToolkitException.ErrorType.DATABASE_ERROR,
+                f"Query returned more than {self.MAX_QUERY_ROWS} rows. Refine the query with filters or LIMIT.",
+            )
+
+    @staticmethod
+    def _cleanup_provider_execution(provider: DatabaseProvider):
+        remove_session = getattr(provider, "remove_session", None)
+        if callable(remove_session):
+            try:
+                remove_session()
+                return
+            except Exception as exc:
+                logging.debug("Failed to remove SQL provider session: %s", exc)
+
+        rollback = getattr(provider, "rollback", None)
+        if callable(rollback):
+            try:
+                rollback()
+            except Exception as exc:
+                logging.debug("Failed to rollback SQL provider session: %s", exc)
+
     def exec_sql(self, company_short_name: str, **kwargs):
         """
         Executes a raw SQL statement against a registered database provider.
@@ -163,27 +258,32 @@ class SqlService:
         database_name = kwargs.get('database_key')
         query = kwargs.get('query')
         format = kwargs.get('format', 'json')
-        commit = kwargs.get('commit')
         params = kwargs.get('params')
+        provider = None
+        cleanup_required = False
 
         if not database_name:
             raise IAToolkitException(IAToolkitException.ErrorType.DATABASE_ERROR,
                                      'missing database_name in call to exec_sql')
+        if kwargs.get('commit'):
+            logging.warning("Ignoring commit=True for read-only SQL execution against '%s'.", database_name)
 
         try:
             # 1. Get the abstract provider (could be Direct or Bridge)
             provider = self.get_database_provider(company_short_name, database_name)
-            db_schema = self._db_schemas[(company_short_name, database_name)]
+            safe_query = self._assert_read_only_query(query)
 
             # 2. Delegate execution
             # The provider returns a clean List[Dict] or Dict result
             execute_kwargs = {
-                "query": query,
-                "commit": commit,
+                "query": safe_query,
+                "commit": False,
             }
             if params is not None:
                 execute_kwargs["params"] = params
+            cleanup_required = True
             result_data = provider.execute_query(**execute_kwargs)
+            self._enforce_result_row_limit(result_data)
 
             # 3. Handle Formatting (Service layer responsibility)
             if format == 'dict':
@@ -195,14 +295,6 @@ class SqlService:
         except IAToolkitException:
             raise
         except Exception as e:
-            # Attempt rollback if supported/needed
-            try:
-                provider = self.get_database_provider(company_short_name, database_name)
-                if provider:
-                    provider.rollback()
-            except Exception:
-                pass
-
             error_message = str(e)
             if 'timed out' in str(e):
                 error_message = self.i18n_service.t('errors.timeout')
@@ -210,6 +302,9 @@ class SqlService:
             logging.error(f"Error executing SQL statement: {error_message}")
             raise IAToolkitException(IAToolkitException.ErrorType.DATABASE_ERROR,
                                      error_message) from e
+        finally:
+            if provider is not None and cleanup_required:
+                self._cleanup_provider_execution(provider)
 
     def commit(self, company_short_name: str, database_name: str):
         """

{iatoolkit-2.18.6 → iatoolkit-2.19.0/src/iatoolkit.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iatoolkit
-Version: 2.18.6
+Version: 2.19.0
 Summary: IAToolkit
 Author: Fernando Libedinsky
 License-Expression: MIT