pythia-plsql 0.1.2__tar.gz → 0.1.3__tar.gz

{pythia_plsql-0.1.2/scripts/pythia_plsql.egg-info → pythia_plsql-0.1.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pythia-plsql
-Version: 0.1.2
+Version: 0.1.3
 Summary: PL/SQL development for AI agents on Oracle Database - expert data-dictionary queries, impact analysis, and a snapshot-verified write path with honest rollback.
 License: MIT
 Project-URL: Homepage, https://github.com/thaildhe172591/pythia
@@ -103,7 +103,7 @@ and WSL are all CI-tested.
 | `ls` find objects | `impact` what depends on it | `journal` list · diff · export · restore |
 | `src` source, compiler line numbers | `errors` compile errors, line:col | `policy` show · set |
 | `args` signatures | `invalid` everything broken | `unistr` exact non-ASCII literals |
-| `ddl` via DBMS_METADATA | `plscope` exact identifier usages | |
+| `ddl` via DBMS_METADATA | `plscope` exact identifier usages | `agent-user` least-privilege setup |
 | `cols` columns + types | `similar` programs named like this | |
 | `grep` search all source | | |
 | `sql` free query (SELECT/WITH only) | | |

{pythia_plsql-0.1.2 → pythia_plsql-0.1.3}/README.md

@@ -89,7 +89,7 @@ and WSL are all CI-tested.
 | `ls` find objects | `impact` what depends on it | `journal` list · diff · export · restore |
 | `src` source, compiler line numbers | `errors` compile errors, line:col | `policy` show · set |
 | `args` signatures | `invalid` everything broken | `unistr` exact non-ASCII literals |
-| `ddl` via DBMS_METADATA | `plscope` exact identifier usages | |
+| `ddl` via DBMS_METADATA | `plscope` exact identifier usages | `agent-user` least-privilege setup |
 | `cols` columns + types | `similar` programs named like this | |
 | `grep` search all source | | |
 | `sql` free query (SELECT/WITH only) | | |

{pythia_plsql-0.1.2 → pythia_plsql-0.1.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "pythia-plsql"
-version = "0.1.2"
+version = "0.1.3"
 description = "PL/SQL development for AI agents on Oracle Database - expert data-dictionary queries, impact analysis, and a snapshot-verified write path with honest rollback."
 readme = "README.md"
 license = { text = "MIT" }

{pythia_plsql-0.1.2 → pythia_plsql-0.1.3}/scripts/pythia.py

@@ -43,6 +43,7 @@ you always know whether you saw everything.
   pythia policy
   pythia install
   pythia unistr "Nhóm không được để trống"
+  pythia agent-user --save
 """
 import argparse
 import json
@@ -1301,6 +1302,76 @@ def cmd_conventions(conn, schema, ns):
         print(f"\nProse rules for agents: {md}")
 
 
+AGENT_USER_SQL = """\
+-- Least-privilege agent credential for schema {owner} — run as a DBA.
+-- Proxy authentication: the agent logs in with its OWN password but works
+-- inside {owner}; it never learns the owner password, owns nothing, and
+-- revocation is one statement. Deliberately absent: DBA, RESOURCE, ANY
+-- privileges, utility grants — the agent needs none of them to develop
+-- PL/SQL, and every extra grant widens the blast radius.
+
+CREATE USER {agent} IDENTIFIED BY "{password}";
+GRANT CREATE SESSION TO {agent};
+ALTER USER {owner} GRANT CONNECT THROUGH {agent};
+
+-- Cut the agent off later (owner untouched):
+--   ALTER USER {owner} REVOKE CONNECT THROUGH {agent};
+-- Fresh owner schema instead? See examples/agent-user-setup.example.sql.
+"""
+
+
+def agent_password():
+    """Random password satisfying common Oracle verify functions: letter
+    first, upper+lower+digit+special, 16+ chars. Always quoted in SQL."""
+    import secrets
+    import string
+    body = "".join(secrets.choice(string.ascii_letters + string.digits)
+                   for _ in range(12))
+    return "Ag" + body + "#7"
+
+
+def save_agent_connection(root, base_name, base, agent, password):
+    """Add <base>_agent alongside the owner entry (never overwrite it) and
+    make it the default. Returns the new entry name."""
+    path = pathlib.Path(root) / CONFIG_DIR / CONFIG_NAME
+    cfg = json.loads(path.read_text(encoding="utf-8"))
+    owner = (base.get("schema") or base["user"]).upper()
+    entry = dict(base)
+    entry["user"] = f"{agent.lower()}[{owner.lower()}]"
+    entry["password"] = password
+    entry["schema"] = owner
+    name = f"{base_name}_agent"
+    cfg[name] = entry
+    cfg["default"] = name
+    path.write_text(json.dumps(cfg, indent=2, ensure_ascii=False) + "\n",
+                    encoding="utf-8")
+    return name
+
+
+def cmd_agent_user(conn, schema, ns):
+    cwd = pathlib.Path.cwd()
+    cfg, root = find_config(cwd, os.environ)
+    base_name, base = resolve_connection(cfg, ns.conn, os.environ, cwd, root)
+    owner = (base.get("schema") or base["user"]).upper()
+    if "[" in base["user"]:
+        sys.exit(f"Connection {base_name} already uses a proxy user "
+                 f"({base['user']}) — nothing to set up.")
+    agent = (ns.name or f"{owner}_AGENT").upper()
+    password = agent_password()
+    print(AGENT_USER_SQL.format(owner=owner, agent=agent, password=password))
+    if ns.save:
+        name = save_agent_connection(root, base_name, base, agent, password)
+        print(f"Saved connection '{name}' (now the default) in "
+              f"{pathlib.Path(root) / CONFIG_DIR / CONFIG_NAME};\n"
+              f"the owner entry '{base_name}' is untouched — switch back "
+              f"any time with --conn {base_name}.")
+        print(f"\nNext: run the SQL above as a DBA, then: {invocation()} check")
+    else:
+        print(f"-- Rerun with --save to add this credential to "
+              f"connections.json as '{base_name}_agent' and make it the "
+              f"default once the DBA has run it.")
+
+
 # unistr escapes. Single quote doubles to '' per SQL (a \' is ORA-01756 for
 # Oracle); backslash doubles for unistr itself.
 UNISTR_ESC = {0: r"\0", 8: r"\b", 9: r"\t", 10: r"\n", 13: r"\r",
@@ -1430,9 +1501,10 @@ COMMANDS = {"check": cmd_check, "ls": cmd_ls, "src": cmd_src, "args": cmd_args,
             "impact": cmd_impact, "similar": cmd_similar, "plscope": cmd_plscope,
             "policy": cmd_policy, "journal": cmd_journal, "apply": cmd_apply,
             "conventions": cmd_conventions, "install": cmd_install,
-            "unistr": cmd_unistr}
+            "unistr": cmd_unistr, "agent-user": cmd_agent_user}
 
-NO_DB_COMMANDS = {"policy", "journal", "conventions", "install", "unistr"}
+NO_DB_COMMANDS = {"policy", "journal", "conventions", "install", "unistr",
+                  "agent-user"}
 
 
 # --- CLI ---------------------------------------------------------------------
@@ -1531,6 +1603,13 @@ def build_parser():
                    help="impact depth for the preview (default 3)")
     sub.add_parser("conventions", parents=[common()],
                    help="show the project's house-style naming patterns")
+    s = sub.add_parser("agent-user", parents=[common()],
+                       help="SQL for a least-privilege proxy agent user; "
+                            "--save adds it to connections.json")
+    s.add_argument("--name", help="agent user name (default <OWNER>_AGENT)")
+    s.add_argument("--save", action="store_true",
+                   help="add the new credential as <conn>_agent and make it "
+                        "the default connection")
     s = sub.add_parser("unistr", parents=[common()],
                        help="Oracle unistr('...') literal for non-ASCII text "
                             "(Vietnamese messages stay exact)")

{pythia_plsql-0.1.2 → pythia_plsql-0.1.3/scripts/pythia_plsql.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pythia-plsql
-Version: 0.1.2
+Version: 0.1.3
 Summary: PL/SQL development for AI agents on Oracle Database - expert data-dictionary queries, impact analysis, and a snapshot-verified write path with honest rollback.
 License: MIT
 Project-URL: Homepage, https://github.com/thaildhe172591/pythia
@@ -103,7 +103,7 @@ and WSL are all CI-tested.
 | `ls` find objects | `impact` what depends on it | `journal` list · diff · export · restore |
 | `src` source, compiler line numbers | `errors` compile errors, line:col | `policy` show · set |
 | `args` signatures | `invalid` everything broken | `unistr` exact non-ASCII literals |
-| `ddl` via DBMS_METADATA | `plscope` exact identifier usages | |
+| `ddl` via DBMS_METADATA | `plscope` exact identifier usages | `agent-user` least-privilege setup |
 | `cols` columns + types | `similar` programs named like this | |
 | `grep` search all source | | |
 | `sql` free query (SELECT/WITH only) | | |

{pythia_plsql-0.1.2 → pythia_plsql-0.1.3}/tests/test_phase1.py

@@ -253,6 +253,45 @@ def test_to_unistr():
     assert u("ABC 123") == "unistr('ABC 123')"
 
 
+def test_agent_user_sql_is_least_privilege():
+    sql = pythia.AGENT_USER_SQL.format(owner="APP", agent="APP_AGENT",
+                                       password="x")
+    assert "CREATE USER APP_AGENT" in sql
+    assert "GRANT CREATE SESSION TO APP_AGENT" in sql
+    assert "GRANT CONNECT THROUGH APP_AGENT" in sql
+    for bad in ("DBA TO", "RESOURCE TO", "ANY "):   # the whole point
+        assert bad not in sql.upper().replace("-- ", ""), bad
+
+
+def test_agent_password_shape():
+    for _ in range(20):
+        pw = pythia.agent_password()
+        assert len(pw) >= 14 and pw[0].isalpha() and "#" in pw
+        assert '"' not in pw and "'" not in pw      # safe inside quotes
+
+
+def test_save_agent_connection_keeps_owner_and_sets_default():
+    with tempfile.TemporaryDirectory() as td:
+        root = pathlib.Path(td)
+        (root / ".pythia").mkdir()
+        cfg = {"default": "dev",
+               "dev": {"host": "h", "port": 1521, "service_name": "svc",
+                       "user": "PYTHIA", "password": "ownerpw",
+                       "schema": "PYTHIA"}}
+        (root / ".pythia" / "connections.json").write_text(
+            json.dumps(cfg), encoding="utf-8")
+        name = pythia.save_agent_connection(root, "dev", cfg["dev"],
+                                            "PYTHIA_AGENT", "agpw")
+        out = json.loads((root / ".pythia" / "connections.json")
+                         .read_text(encoding="utf-8"))
+        assert name == "dev_agent" and out["default"] == "dev_agent"
+        assert out["dev"]["user"] == "PYTHIA"          # owner untouched
+        assert out["dev"]["password"] == "ownerpw"
+        assert out["dev_agent"]["user"] == "pythia_agent[pythia]"
+        assert out["dev_agent"]["password"] == "agpw"
+        assert out["dev_agent"]["host"] == "h"         # connect details copied
+
+
 def test_json_envelope():
     s = pythia.json_envelope("ls", "DEV", "OWNER1", ["A", "B"],
                              [(1, datetime.date(2026, 1, 2))], truncated=True)