iatoolkit 2.18.7__tar.gz → 2.20.0__tar.gz

{iatoolkit-2.18.7/src/iatoolkit.egg-info → iatoolkit-2.20.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iatoolkit
-Version: 2.18.7
+Version: 2.20.0
 Summary: IAToolkit
 Author: Fernando Libedinsky
 License-Expression: MIT

{iatoolkit-2.18.7 → iatoolkit-2.20.0}/src/iatoolkit/__init__.py

@@ -3,7 +3,7 @@
 #
 # IAToolkit is open source software.
 
-__version__ = "2.18.7"
+__version__ = "2.20.0"
 
 # Expose main classes and functions at the top level of the package
 

{iatoolkit-2.18.7 → iatoolkit-2.20.0}/src/iatoolkit/repositories/database_manager.py

@@ -19,6 +19,7 @@ class DatabaseManager(DatabaseProvider):
     _POSTGRES_BOOTSTRAP_PATCHES = (
     )
     _DEFAULT_CONNECT_TIMEOUT = 60
+    MAX_RESULT_ROWS = 1000
 
     @inject
     def __init__(self,
@@ -42,6 +43,7 @@ class DatabaseManager(DatabaseProvider):
 
         self.url = make_url(database_url)
         self.backend = self.url.get_backend_name()
+        self.statement_timeout_seconds = self._resolve_statement_timeout(timeout)
         if self._is_redshift():
             self._ensure_redshift_dialect_registered()
         self.engine_url = self._build_engine_url()
@@ -114,6 +116,13 @@ class DatabaseManager(DatabaseProvider):
 
         return self.timeout
 
+    def _resolve_statement_timeout(self, timeout: int | str | None) -> int | None:
+        explicit_timeout = timeout is not None
+        url_timeout_present = any(self.url.query.get(key) is not None for key in ("timeout", "connect_timeout"))
+        if not explicit_timeout and not url_timeout_present:
+            return None
+        return self._resolve_timeout()
+
     def _build_engine_url(self):
         normalized_url = self.url
         if self._is_redshift():
@@ -216,6 +225,15 @@ class DatabaseManager(DatabaseProvider):
     def get_dialect(self) -> str:
         return str(self.backend or "").strip().lower()
 
+    def _apply_statement_timeout(self, session) -> None:
+        if not self._is_postgres():
+            return
+        if self.statement_timeout_seconds is None:
+            return
+
+        timeout_ms = max(int(self.statement_timeout_seconds * 1000), 1)
+        session.execute(text(f"SET LOCAL statement_timeout = {timeout_ms}"))
+
     def create_all(self):
         # if there is a schema defined, make sure it exists before creating tables
         if self.schema and self._is_postgres():
@@ -264,6 +282,7 @@ class DatabaseManager(DatabaseProvider):
             normalized_schema = str(self.schema or "").strip()
             if normalized_schema and normalized_schema.lower() != "public":
                 session.execute(text(f"SET search_path TO {normalized_schema}, public"))
+        self._apply_statement_timeout(session)
 
         result = session.execute(text(query), params or {})
         if commit:
@@ -272,7 +291,12 @@ class DatabaseManager(DatabaseProvider):
         if result.returns_rows:
             # Convert SQLAlchemy rows to list of dicts immediately
             cols = result.keys()
-            return [dict(zip(cols, row)) for row in result.fetchall()]
+            rows = result.fetchmany(self.MAX_RESULT_ROWS + 1)
+            if len(rows) > self.MAX_RESULT_ROWS:
+                raise ValueError(
+                    f"Query returned more than {self.MAX_RESULT_ROWS} rows. Refine the query with filters or LIMIT."
+                )
+            return [dict(zip(cols, row)) for row in rows]
 
         return {'rowcount': result.rowcount}
 

{iatoolkit-2.18.7 → iatoolkit-2.20.0}/src/iatoolkit/runtime_logging.py

@@ -19,7 +19,7 @@ def configure_runtime_logging() -> None:
     log_level = _runtime_log_level()
 
     _ensure_stdout_handler(logging.getLogger(), formatter, log_level)
-    _ensure_stdout_handler(logging.getLogger(RUNTIME_LOGGER_NAME), formatter, log_level)
+    logging.getLogger(RUNTIME_LOGGER_NAME).propagate = True
     _preserve_stdout_handler_across_basic_config(formatter)
 
     seen_handlers: set[int] = set()

{iatoolkit-2.18.7 → iatoolkit-2.20.0}/src/iatoolkit/services/company_context_service.py

@@ -50,6 +50,7 @@ class CompanyContextService:
         company_short_name: str,
         *,
         include_sql_context: bool = True,
+        include_yaml_context: bool = True,
         selected_context_files: List[str] | None = None,
     ) -> dict[str, str]:
         """
@@ -83,17 +84,18 @@ class CompanyContextService:
             except Exception as e:
                 logging.warning(f"Could not generate SQL context for '{company_short_name}': {e}")
 
-        # 4. Context from residual yaml (schema/*.yaml) files
-        try:
-            yaml_schema_context = self._get_yaml_schema_context(
-                company_short_name,
-                db_tables,
-                sql_source_table_scopes=sql_source_table_scopes,
-            ).strip()
-            if yaml_schema_context:
-                yaml_context = f"## Esquemas adicionales\n\n{yaml_schema_context}"
-        except Exception as e:
-            logging.warning(f"Could not load Yaml context for '{company_short_name}': {e}")
+        # 3. Context from residual yaml (schema/*.yaml) files
+        if include_yaml_context:
+            try:
+                yaml_schema_context = self._get_yaml_schema_context(
+                    company_short_name,
+                    db_tables,
+                    sql_source_table_scopes=sql_source_table_scopes,
+                ).strip()
+                if yaml_schema_context:
+                    yaml_context = f"## Esquemas adicionales\n\n{yaml_schema_context}"
+            except Exception as e:
+                logging.warning(f"Could not load Yaml context for '{company_short_name}': {e}")
 
         return {
             "markdown_context": md_context,

{iatoolkit-2.18.7 → iatoolkit-2.20.0}/src/iatoolkit/services/configuration_service.py

@@ -247,10 +247,6 @@ class ConfigurationService:
             # 5. Register Knowledge base information
             self._register_knowledge_base(company_short_name, config)
 
-            # 6. Sync SQL source catalog from YAML to DB.
-            # Runtime registration is resolved from DB entries.
-            self._sync_sql_sources(company_short_name, config)
-
         # Keep runtime cache aligned with the latest loaded configuration.
         self._loaded_configs[company_short_name] = config or {}
 
@@ -388,7 +384,6 @@ class ConfigurationService:
                               config: dict = None):
         """
         Resolves runtime SQL registrations from the SQL source catalog table.
-        YAML data_sources are synchronized into the catalog before refresh.
 
         Public method: Can be called externally after initialization (e.g. by Enterprise)
         to re-register sources once new factories (like 'bridge') are available.
@@ -402,8 +397,6 @@ class ConfigurationService:
         if not config:
             return
 
-        self._sync_sql_sources(company_short_name, config or {})
-
         from iatoolkit import current_iatoolkit
         from iatoolkit.services.sql_source_service import SqlSourceService
         sql_source_service = current_iatoolkit().get_injector().get(SqlSourceService)

{iatoolkit-2.18.7 → iatoolkit-2.20.0}/src/iatoolkit/services/context_builder_service.py

@@ -354,7 +354,11 @@ class ContextBuilderService:
                 collection_names=rag_collections,
             )
 
-        company_context_blocks = self.company_context_service.get_company_context_blocks(company_short_name)
+        company_context_blocks = self.company_context_service.get_company_context_blocks(
+            company_short_name,
+            include_sql_context=False,
+            include_yaml_context=False,
+        )
         final_system_context = self._join_context_sections(
             rendered_sections.get("identity"),
             rendered_sections.get("business_context"),
@@ -364,7 +368,6 @@ class ContextBuilderService:
             collection_context,
             rendered_sections.get("data_access_rules"),
             sql_context,
-            company_context_blocks.get("yaml_context"),
             rendered_sections.get("output_contract"),
         )
 

{iatoolkit-2.18.7 → iatoolkit-2.20.0}/src/iatoolkit/services/sql_service.py

@@ -12,6 +12,7 @@ from injector import inject, singleton
 from typing import Callable
 import json
 import logging
+import re
 
 
 @singleton
@@ -20,6 +21,20 @@ class SqlService:
     Manages database connections and executes SQL statements.
     It maintains a cache of named DatabaseManager instances to avoid reconnecting.
     """
+    MAX_QUERY_ROWS = 1000
+    _ALLOWED_QUERY_PREFIXES = ("SELECT", "WITH")
+    _BLOCKED_SQL_PATTERN = re.compile(
+        r"\b(?:INSERT|UPDATE|DELETE|DROP|ALTER|CREATE|TRUNCATE|MERGE|CALL|COPY|GRANT|REVOKE|"
+        r"BEGIN|COMMIT|ROLLBACK|SAVEPOINT|RELEASE|VACUUM|ANALYZE|CLUSTER|REFRESH|"
+        r"EXEC(?:UTE)?|DO|SET|RESET|USE|PRAGMA|ATTACH|DETACH|REINDEX|LOCK|UNLOCK|INTO)\b",
+        re.IGNORECASE,
+    )
+    _SINGLE_QUOTED_LITERAL_RE = re.compile(r"'(?:''|[^'])*'")
+    _DOUBLE_QUOTED_LITERAL_RE = re.compile(r'"(?:""|[^"])*"')
+    _BACKTICK_LITERAL_RE = re.compile(r"`[^`]*`")
+    _BRACKET_LITERAL_RE = re.compile(r"\[[^\]]*\]")
+    _BLOCK_COMMENT_RE = re.compile(r"/\*.*?\*/", re.DOTALL)
+    _LINE_COMMENT_RE = re.compile(r"--[^\r\n]*")
 
     @inject
     def __init__(self,
@@ -155,6 +170,92 @@ class SqlService:
                 f"Database '{db_name}' is not registered for this company."
             )
 
+    @classmethod
+    def _sanitize_sql_for_validation(cls, query: str) -> str:
+        sanitized = str(query or "")
+        for pattern in (
+            cls._SINGLE_QUOTED_LITERAL_RE,
+            cls._DOUBLE_QUOTED_LITERAL_RE,
+            cls._BACKTICK_LITERAL_RE,
+            cls._BRACKET_LITERAL_RE,
+        ):
+            sanitized = pattern.sub(" ", sanitized)
+        sanitized = cls._BLOCK_COMMENT_RE.sub("", sanitized)
+        sanitized = cls._LINE_COMMENT_RE.sub("", sanitized)
+        return re.sub(r"\s+", " ", sanitized).strip()
+
+    def _assert_read_only_query(self, query: str) -> str:
+        normalized_query = str(query or "").strip()
+        if not normalized_query:
+            raise IAToolkitException(
+                IAToolkitException.ErrorType.DATABASE_ERROR,
+                "SQL query is required.",
+            )
+
+        sanitized = self._sanitize_sql_for_validation(normalized_query)
+        if not sanitized:
+            raise IAToolkitException(
+                IAToolkitException.ErrorType.DATABASE_ERROR,
+                "SQL query is required.",
+            )
+        sanitized_without_trailing_semicolon = re.sub(r";+\s*$", "", sanitized).strip()
+        if not sanitized_without_trailing_semicolon:
+            raise IAToolkitException(
+                IAToolkitException.ErrorType.DATABASE_ERROR,
+                "SQL query is required.",
+            )
+        if ";" in sanitized_without_trailing_semicolon:
+            raise IAToolkitException(
+                IAToolkitException.ErrorType.DATABASE_ERROR,
+                "Only a single read-only SQL statement is allowed.",
+            )
+
+        upper_sanitized = sanitized_without_trailing_semicolon.upper()
+        blocked_match = self._BLOCKED_SQL_PATTERN.search(upper_sanitized)
+        if blocked_match:
+            blocked_keyword = blocked_match.group(0).upper()
+            raise IAToolkitException(
+                IAToolkitException.ErrorType.DATABASE_ERROR,
+                f"Blocked SQL keyword detected: {blocked_keyword}.",
+            )
+
+        if not upper_sanitized.startswith(self._ALLOWED_QUERY_PREFIXES):
+            raise IAToolkitException(
+                IAToolkitException.ErrorType.DATABASE_ERROR,
+                "Only read-only SELECT statements are allowed.",
+            )
+        if upper_sanitized.startswith("WITH") and not re.search(r"\bSELECT\b", upper_sanitized):
+            raise IAToolkitException(
+                IAToolkitException.ErrorType.DATABASE_ERROR,
+                "WITH queries must resolve to a read-only SELECT statement.",
+            )
+
+        return normalized_query
+
+    def _enforce_result_row_limit(self, result_data):
+        if isinstance(result_data, list) and len(result_data) > self.MAX_QUERY_ROWS:
+            raise IAToolkitException(
+                IAToolkitException.ErrorType.DATABASE_ERROR,
+                f"Query returned more than {self.MAX_QUERY_ROWS} rows. Refine the query with filters or LIMIT.",
+            )
+
+    @staticmethod
+    def _cleanup_provider_execution(provider: DatabaseProvider):
+        remove_session = getattr(provider, "remove_session", None)
+        if callable(remove_session):
+            try:
+                remove_session()
+                return
+            except Exception as exc:
+                logging.debug("Failed to remove SQL provider session: %s", exc)
+
+        rollback = getattr(provider, "rollback", None)
+        if callable(rollback):
+            try:
+                rollback()
+            except Exception as exc:
+                logging.debug("Failed to rollback SQL provider session: %s", exc)
+
     def exec_sql(self, company_short_name: str, **kwargs):
         """
         Executes a raw SQL statement against a registered database provider.
@@ -163,27 +264,32 @@ class SqlService:
         database_name = kwargs.get('database_key')
         query = kwargs.get('query')
         format = kwargs.get('format', 'json')
-        commit = kwargs.get('commit')
         params = kwargs.get('params')
+        provider = None
+        cleanup_required = False
 
         if not database_name:
             raise IAToolkitException(IAToolkitException.ErrorType.DATABASE_ERROR,
                                      'missing database_name in call to exec_sql')
+        if kwargs.get('commit'):
+            logging.warning("Ignoring commit=True for read-only SQL execution against '%s'.", database_name)
 
         try:
             # 1. Get the abstract provider (could be Direct or Bridge)
             provider = self.get_database_provider(company_short_name, database_name)
-            db_schema = self._db_schemas[(company_short_name, database_name)]
+            safe_query = self._assert_read_only_query(query)
 
             # 2. Delegate execution
             # The provider returns a clean List[Dict] or Dict result
             execute_kwargs = {
-                "query": query,
-                "commit": commit,
+                "query": safe_query,
+                "commit": False,
             }
             if params is not None:
                 execute_kwargs["params"] = params
+            cleanup_required = True
             result_data = provider.execute_query(**execute_kwargs)
+            self._enforce_result_row_limit(result_data)
 
             # 3. Handle Formatting (Service layer responsibility)
             if format == 'dict':
@@ -195,14 +301,6 @@ class SqlService:
         except IAToolkitException:
             raise
         except Exception as e:
-            # Attempt rollback if supported/needed
-            try:
-                provider = self.get_database_provider(company_short_name, database_name)
-                if provider:
-                    provider.rollback()
-            except Exception:
-                pass
-
             error_message = str(e)
             if 'timed out' in str(e):
                 error_message = self.i18n_service.t('errors.timeout')
@@ -210,6 +308,9 @@ class SqlService:
             logging.error(f"Error executing SQL statement: {error_message}")
             raise IAToolkitException(IAToolkitException.ErrorType.DATABASE_ERROR,
                                      error_message) from e
+        finally:
+            if provider is not None and cleanup_required:
+                self._cleanup_provider_execution(provider)
 
     def commit(self, company_short_name: str, database_name: str):
         """

{iatoolkit-2.18.7 → iatoolkit-2.20.0/src/iatoolkit.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iatoolkit
-Version: 2.18.7
+Version: 2.20.0
 Summary: IAToolkit
 Author: Fernando Libedinsky
 License-Expression: MIT