querysource 4.5.7__tar.gz → 4.5.8__tar.gz

{querysource-4.5.7 → querysource-4.5.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: querysource
-Version: 4.5.7
+Version: 4.5.8
 Summary: Aiohttp web service for querying several databases easily
 Author-email: Jesus Lara <jesuslarag@gmail.com>
 License: BSD-3-Clause

{querysource-4.5.7 → querysource-4.5.8}/querysource/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '4.5.8.dev0+g201ef3bdd.d20260702'
-__version_tuple__ = version_tuple = (4, 5, 8, 'dev0', 'g201ef3bdd.d20260702')
+__version__ = version = '4.5.9.dev0+g5159ecc88.d20260708'
+__version_tuple__ = version_tuple = (4, 5, 9, 'dev0', 'g5159ecc88.d20260708')
 
-__commit_id__ = commit_id = 'g201ef3bdd'
+__commit_id__ = commit_id = 'g5159ecc88'

{querysource-4.5.7 → querysource-4.5.8}/querysource/handlers/executor.py

@@ -120,6 +120,12 @@ class QueryExecutor(AbstractHandler):
                 response='QS: Missing driver or datasource for introspection.',
                 status=410  # bad request
             )
+        # `table` is an introspection-only field (lazy column loading). Pull it
+        # out BEFORE building the Query model: the model is strict and rejects
+        # unknown kwargs, so leaving `table` in the payload makes get_executor
+        # fail on the columns request while the tables request (no `table`)
+        # succeeds.
+        table = payload.pop('table', None) if isinstance(payload, dict) else None
         try:
             query = self.get_executor(payload, request)
         except QueryError as ex:
@@ -129,7 +135,6 @@ class QueryExecutor(AbstractHandler):
             return self.critical(reason={"message": str(ex)}, status=500)
         # PBAC: enforce the same datasource/driver checks as a query run.
         await self._enforce_payload(request, payload, query)
-        table = payload.get('table') if isinstance(payload, dict) else None
         try:
             result = await query.introspect(table=table)
             return self.json_response(

{querysource-4.5.7 → querysource-4.5.8}/querysource/providers/abstract.py

@@ -130,6 +130,21 @@ class BaseProvider(ABC):
         """
         return self._definition
 
+    def _get_cond_definition(self) -> dict:
+        """Return the per-placeholder type hints (`cond_definition`) declared on
+        the Query definition, used by the Rust validating substitution
+        (`safe_format_map_validated`) to type-check raw-query conditions.
+
+        Supports both `QueryModel` objects (attribute access) and plain dicts,
+        and normalizes a missing/None definition to an empty dict.
+        """
+        definition = self._definition
+        if isinstance(definition, dict):
+            cond_definition = definition.get('cond_definition')
+        else:
+            cond_definition = getattr(definition, 'cond_definition', None)
+        return cond_definition or {}
+
     def NotFound(self, message: str):
         """Raised when Data not Found.
         """

{querysource-4.5.7 → querysource-4.5.8}/querysource/providers/cassandra.py

@@ -73,13 +73,19 @@ class cassandraProvider(BaseProvider):
             sql = _rs.safe_format_map(query, self.replacement)
             if self._conditions:
                 try:
-                    sql = _rs.safe_format_map_validated(sql, self._conditions, {})
+                    sql = _rs.safe_format_map_validated(sql, self._conditions, self._get_cond_definition())
                 except ValueError as err:
                     self._logger.warning(
                         "get_raw_query: validating substitution rejected conditions: %s", err
                     )
                     raise ParserError("Invalid query conditions") from err
             return sql
+        # DIVERGENCE (FEAT-103): pure-Python fallback (HAS_RUST=False) has no
+        # injection validation and ignores cond_definition entirely — type
+        # hints (e.g. "array") only take effect via the Rust path. Accepted
+        # because the Rust extension is required in all supported
+        # deployments; replicating context-aware validation in pure Python
+        # would duplicate the security-critical logic in two places.
         conditions = {**self.replacement, **(self._conditions or {})}
         return query.format_map(
             defaultdict(str, SafeDict(**conditions))

{querysource-4.5.7 → querysource-4.5.8}/querysource/providers/default.py

@@ -72,13 +72,19 @@ class defaultProvider(BaseProvider):
             sql = _rs.safe_format_map(query, self.replacement)
             if self._conditions:
                 try:
-                    sql = _rs.safe_format_map_validated(sql, self._conditions, {})
+                    sql = _rs.safe_format_map_validated(sql, self._conditions, self._get_cond_definition())
                 except ValueError as err:
                     self._logger.warning(
                         "raw_query: validating substitution rejected conditions: %s", err
                     )
                     raise ParserError("Invalid query conditions") from err
             return sql
+        # DIVERGENCE (FEAT-103): pure-Python fallback (HAS_RUST=False) has no
+        # injection validation and ignores cond_definition entirely — type
+        # hints (e.g. "array") only take effect via the Rust path. Accepted
+        # because the Rust extension is required in all supported
+        # deployments; replicating context-aware validation in pure Python
+        # would duplicate the security-critical logic in two places.
         conditions = {**self.replacement, **(self._conditions or {})}
         return query.format_map(
             defaultdict(str, SafeDict(**conditions))

{querysource-4.5.7 → querysource-4.5.8}/querysource/providers/documentdb.py

@@ -97,7 +97,7 @@ class documentdbProvider(BaseProvider):
             if HAS_RUST:
                 try:
                     sql = _rs.safe_format_map(query, self.replacement)
-                    substituted = _rs.safe_format_map_validated(sql, self._conditions, {})
+                    substituted = _rs.safe_format_map_validated(sql, self._conditions, self._get_cond_definition())
                     try:
                         return json_decoder(substituted)
                     except Exception:
@@ -108,6 +108,13 @@ class documentdbProvider(BaseProvider):
                     )
                     raise ParserError("Invalid query conditions") from err
             # Fallback when Rust is unavailable
+            # DIVERGENCE (FEAT-103): pure-Python fallback has no injection
+            # validation and ignores cond_definition entirely — type hints
+            # (e.g. "array") only take effect via the Rust path. Accepted
+            # because the Rust extension is required in all supported
+            # deployments; replicating context-aware validation in pure
+            # Python would duplicate the security-critical logic in two
+            # places.
             try:
                 return query.format_map(
                     defaultdict(str, SafeDict(**self._conditions))

{querysource-4.5.7 → querysource-4.5.8}/querysource/providers/mysql.py

@@ -107,13 +107,19 @@ class mysqlProvider(BaseProvider):
             sql = _rs.safe_format_map(query, self.replacement)
             if self._conditions:
                 try:
-                    sql = _rs.safe_format_map_validated(sql, self._conditions, {})
+                    sql = _rs.safe_format_map_validated(sql, self._conditions, self._get_cond_definition())
                 except ValueError as err:
                     self._logger.warning(
                         "raw_query: validating substitution rejected conditions: %s", err
                     )
                     raise ParserError("Invalid query conditions") from err
             return sql
+        # DIVERGENCE (FEAT-103): pure-Python fallback (HAS_RUST=False) has no
+        # injection validation and ignores cond_definition entirely — type
+        # hints (e.g. "array") only take effect via the Rust path. Accepted
+        # because the Rust extension is required in all supported
+        # deployments; replicating context-aware validation in pure Python
+        # would duplicate the security-critical logic in two places.
         conditions = {**self.replacement, **(self._conditions or {})}
         return query.format_map(
             defaultdict(str, SafeDict(**conditions))

{querysource-4.5.7 → querysource-4.5.8}/querysource/providers/sql.py

@@ -172,7 +172,7 @@ class sqlProvider(BaseProvider):
             # Phase 2: untrusted user-supplied conditions (if any)
             if self._conditions:
                 try:
-                    sql = _rs.safe_format_map_validated(sql, self._conditions, {})
+                    sql = _rs.safe_format_map_validated(sql, self._conditions, self._get_cond_definition())
                 except ValueError as err:
                     self._logger.warning(
                         "raw_query: validating substitution rejected conditions: %s", err
@@ -180,6 +180,12 @@ class sqlProvider(BaseProvider):
                     raise ParserError("Invalid query conditions") from err
             return sql
         # Fallback when Rust is unavailable (should not happen in production)
+        # DIVERGENCE (FEAT-103): pure-Python fallback has no injection
+        # validation and ignores cond_definition entirely — type hints
+        # (e.g. "array") only take effect via the Rust path. Accepted
+        # because the Rust extension is required in all supported
+        # deployments; replicating context-aware validation in pure Python
+        # would duplicate the security-critical logic in two places.
         conditions = {**self.replacement, **(self._conditions or {})}
         return query.format_map(
             defaultdict(str, SafeDict(**conditions))
@@ -191,13 +197,19 @@ class sqlProvider(BaseProvider):
             sql = _rs.safe_format_map(query, self.replacement)
             if self._conditions:
                 try:
-                    sql = _rs.safe_format_map_validated(sql, self._conditions, {})
+                    sql = _rs.safe_format_map_validated(sql, self._conditions, self._get_cond_definition())
                 except ValueError as err:
                     self._logger.warning(
                         "get_raw_query: validating substitution rejected conditions: %s", err
                     )
                     raise ParserError("Invalid query conditions") from err
             return sql
+        # DIVERGENCE (FEAT-103): pure-Python fallback has no injection
+        # validation and ignores cond_definition entirely — type hints
+        # (e.g. "array") only take effect via the Rust path. Accepted
+        # because the Rust extension is required in all supported
+        # deployments; replicating context-aware validation in pure Python
+        # would duplicate the security-critical logic in two places.
         conditions = {**self.replacement, **(self._conditions or {})}
         return query.format_map(
             defaultdict(str, SafeDict(**conditions))

{querysource-4.5.7 → querysource-4.5.8}/querysource/providers/sqlserver.py

@@ -86,13 +86,19 @@ class sqlserverProvider(BaseProvider):
             sql = _rs.safe_format_map(query, self.replacement)
             if self._conditions:
                 try:
-                    sql = _rs.safe_format_map_validated(sql, self._conditions, {})
+                    sql = _rs.safe_format_map_validated(sql, self._conditions, self._get_cond_definition())
                 except ValueError as err:
                     self._logger.warning(
                         "get_raw_query: validating substitution rejected conditions: %s", err
                     )
                     raise ParserError("Invalid query conditions") from err
             return sql
+        # DIVERGENCE (FEAT-103): pure-Python fallback (HAS_RUST=False) has no
+        # injection validation and ignores cond_definition entirely — type
+        # hints (e.g. "array") only take effect via the Rust path. Accepted
+        # because the Rust extension is required in all supported
+        # deployments; replicating context-aware validation in pure Python
+        # would duplicate the security-critical logic in two places.
         conditions = {**self.replacement, **(self._conditions or {})}
         return query.format_map(
             defaultdict(str, SafeDict(**conditions))

{querysource-4.5.7 → querysource-4.5.8}/querysource/version.py

@@ -6,7 +6,7 @@ __description__ = (
     'QuerySource Query parser and generator.'
     'Supports SQL, NoSQL, MongoDB, Cassandra, Elasticsearch, etc.'
 )
-__version__ = '4.5.7'
+__version__ = '4.5.8'
 __url__ = 'https://github.com/phenobarbital/querysource'
 __copyright__ = 'Copyright (c) 2018-2025 Jesus Lara'
 __author__ = 'Jesus Lara'

{querysource-4.5.7 → querysource-4.5.8}/querysource.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: querysource
-Version: 4.5.7
+Version: 4.5.8
 Summary: Aiohttp web service for querying several databases easily
 Author-email: Jesus Lara <jesuslarag@gmail.com>
 License: BSD-3-Clause

{querysource-4.5.7 → querysource-4.5.8}/querysource.egg-info/SOURCES.txt

@@ -621,4 +621,5 @@ tests/services/test_querysource_setup_pbac.py
 tests/unit/test_cython_filter_fallback.py
 tests/unit/test_datasource_redaction.py
 tests/unit/test_provider_raw_query_validated.py
-tests/unit/test_qs_parsers_validated.py
+tests/unit/test_qs_parsers_validated.py
+tests/unit/test_raw_query_cond_definition_wiring.py

{querysource-4.5.7 → querysource-4.5.8}/querysource.egg-info/scm_file_list.json

@@ -595,6 +595,7 @@
     "tests/unit/test_datasource_redaction.py",
     "tests/unit/test_qs_parsers_validated.py",
     "tests/unit/test_provider_raw_query_validated.py",
+    "tests/unit/test_raw_query_cond_definition_wiring.py",
     "tests/interfaces/__init__.py",
     "tests/interfaces/test_airtable_interface.py",
     "sdd/WORKFLOW-parrot.md",

querysource-4.5.8/querysource.egg-info/scm_version.json

@@ -0,0 +1,8 @@
+{
+  "tag": "4.5.8",
+  "distance": 0,
+  "node": "g5159ecc88e11909177461d43f6a18bcd2c9fd850",
+  "dirty": true,
+  "branch": "HEAD",
+  "node_date": "2026-07-08"
+}

querysource-4.5.8/rust/Cargo.toml

@@ -0,0 +1,34 @@
+[package]
+name = "qs_parsers"
+version = "0.1.0"
+edition = "2021"
+description = "Rust-based string processing for QuerySource parsers"
+
+[lib]
+name = "_qs_parsers"
+crate-type = ["cdylib"]
+
+[dependencies]
+pyo3 = { version = "0.24" }
+rayon = "1.10"
+regex = "1.11"
+once_cell = "1.20"
+
+[dev-dependencies]
+proptest = "1.4"
+
+# `extension-module` tells PyO3 the symbols it needs (Py_InitializeEx, etc.)
+# will be provided at dlopen time by an embedding Python process, so it must
+# NOT link libpython itself. That's correct for the cdylib maturin builds,
+# but it breaks `cargo test`, which links a normal executable and therefore
+# needs those symbols resolved directly against libpython.
+# Gate it behind a feature (on by default, so `cargo build`/`maturin build`
+# are unaffected) and run tests with `cargo test --no-default-features`.
+[features]
+default = ["extension-module"]
+extension-module = ["pyo3/extension-module"]
+
+[profile.release]
+opt-level = 3
+lto = true
+codegen-units = 1

{querysource-4.5.7 → querysource-4.5.8}/rust/src/safe_dict.rs

@@ -487,4 +487,73 @@ mod tests {
         // "xUNIONy" — UNION is NOT a standalone word → allow
         assert!(check_injection("xUNIONy").is_ok());
     }
+
+    // --- FEAT-103 cond_definition wiring tests ---
+
+    /// `array` hint in Bare context emits a pre-rendered list verbatim
+    /// (e.g. `IN ({ids})` with conditions={"ids": "'a','b','c'"}).
+    #[test]
+    fn cond_definition_array_hint_bare_context_passthrough() {
+        let r = safe_format_map_validated_rust(
+            "SELECT * FROM t WHERE id IN ({ids})",
+            &map(&[("ids", "'a','b','c'")]),
+            &map(&[("ids", "array")]),
+        )
+        .unwrap();
+        assert_eq!(r, "SELECT * FROM t WHERE id IN ('a','b','c')");
+    }
+
+    /// `array` hint does NOT bypass injection checks: check_injection runs
+    /// before the type-hint dispatch, so a `;`/comment/keyword payload is
+    /// still rejected even though the hint would otherwise pass the value
+    /// through unquoted.
+    #[test]
+    fn cond_definition_array_hint_rejects_injection_payload() {
+        let r = safe_format_map_validated_rust(
+            "SELECT * FROM t WHERE id IN ({ids})",
+            &map(&[("ids", "'a'); DROP TABLE t;--")]),
+            &map(&[("ids", "array")]),
+        );
+        assert!(r.is_err(), "Expected rejection of injection payload under array hint");
+
+        let r2 = safe_format_map_validated_rust(
+            "SELECT * FROM t WHERE id IN ({ids})",
+            &map(&[("ids", "1 UNION SELECT password FROM users")]),
+            &map(&[("ids", "array")]),
+        );
+        assert!(r2.is_err(), "Expected rejection of UNION payload under array hint");
+    }
+
+    /// cond_definition hints in upper case (as persisted by the Navigator
+    /// frontend) match the same as lower case.
+    #[test]
+    fn cond_definition_uppercase_hint_matches_lowercase() {
+        let upper = safe_format_map_validated_rust(
+            "WHERE id IN ({ids})",
+            &map(&[("ids", "'a','b'")]),
+            &map(&[("ids", "ARRAY")]),
+        )
+        .unwrap();
+        let lower = safe_format_map_validated_rust(
+            "WHERE id IN ({ids})",
+            &map(&[("ids", "'a','b'")]),
+            &map(&[("ids", "array")]),
+        )
+        .unwrap();
+        assert_eq!(upper, lower);
+        assert_eq!(upper, "WHERE id IN ('a','b')");
+    }
+
+    /// Regression: with an empty cond_definition (pre-fix behavior), a bare
+    /// placeholder still falls through to the generic quoting logic.
+    #[test]
+    fn cond_definition_empty_preserves_generic_quoting() {
+        let r = safe_format_map_validated_rust(
+            "WHERE tag = {tag}",
+            &map(&[("tag", "hello")]),
+            &map(&[]),
+        )
+        .unwrap();
+        assert_eq!(r, "WHERE tag = 'hello'");
+    }
 }

{querysource-4.5.7 → querysource-4.5.8}/rust/src/validators.rs

@@ -250,7 +250,8 @@ pub fn to_unquoted(value: &str) -> String {
 /// Mirrors `is_valid()` from validators.pyx.
 /// Returns the properly formatted value for SQL inclusion.
 ///
-/// Type dispatch:
+/// Type dispatch (case-insensitive — callers such as the Navigator frontend
+/// persist `cond_definition` hints in upper case, e.g. `"STRING"`):
 /// - `literal` → escape_string
 /// - `integer`/`int`/`float`/`numeric`/`decimal` → unquoted
 /// - `string`/`varchar`/`field` → quote_string(escape_string(v))
@@ -271,9 +272,10 @@ pub fn is_valid(
     type_hint: Option<&str>,
     noquote: bool,
 ) -> String {
-    // Type hint dispatch
+    // Type hint dispatch (case-insensitive)
     if let Some(t) = type_hint {
-        match t {
+        let lowered = t.to_lowercase();
+        match lowered.as_str() {
             "literal" => return escape_string(value),
             "int" | "integer" | "float" | "numeric" | "decimal" | "epoch" => {
                 return to_unquoted(value);
@@ -416,6 +418,24 @@ mod tests {
         assert_eq!(is_valid("x", "hello", Some("string"), false), "'hello'");
     }
 
+    /// FEAT-103: cond_definition hints arrive upper-cased from the Navigator
+    /// frontend (`"STRING"`, `"INTEGER"`, `"BOOLEAN"`, `"ARRAY"`) — dispatch
+    /// must be case-insensitive.
+    #[test]
+    fn test_is_valid_uppercase_hint_matches_lowercase() {
+        assert_eq!(is_valid("x", "42", Some("INTEGER"), false), "42");
+        assert_eq!(is_valid("x", "hello", Some("STRING"), false), "'hello'");
+        assert_eq!(is_valid("x", "true", Some("BOOLEAN"), false), "TRUE");
+        assert_eq!(
+            is_valid("x", "'a','b','c'", Some("ARRAY"), false),
+            "'a','b','c'"
+        );
+        assert_eq!(
+            is_valid("x", "'a','b','c'", Some("array"), false),
+            is_valid("x", "'a','b','c'", Some("ARRAY"), false)
+        );
+    }
+
     #[test]
     fn test_is_valid_null() {
         assert_eq!(is_valid("x", "null", None, false), "null");

querysource-4.5.8/tests/unit/test_raw_query_cond_definition_wiring.py

@@ -0,0 +1,182 @@
+"""Integration tests for cond_definition wiring in raw_query() (FEAT-103).
+
+Prior to this fix, providers called
+`safe_format_map_validated(sql, self._conditions, {})` with a hard-coded
+empty dict, so the `cond_definition` type hints saved on a slug's
+QueryModel (e.g. {"ids": "ARRAY"}) never reached the Rust validator and
+had no effect on substitution.
+
+These tests exercise the real `defaultProvider.raw_query()` (and, as a
+cross-provider sanity check, `cassandraProvider.get_raw_query()`) against
+a fixture QueryModel carrying `cond_definition`, verifying:
+  - the "array" type hint now takes effect (values pass through unquoted,
+    e.g. for a pre-rendered `IN (...)` list), fixing Bug 1;
+  - hints persisted in upper case (as the Navigator frontend does) are
+    honored the same as lower case, fixing Bug 2;
+  - the injection check still runs even when the "array" hint applies.
+
+`BaseProvider.__init__` requires a running asyncio loop (it calls
+`asyncio.get_running_loop()`), so provider-instantiating tests are
+`async def` — `asyncio_mode = auto` (pytest.ini) runs them under one.
+"""
+import sys
+import types
+import logging as _stdlib_logging
+
+import pytest
+
+# Importing `querysource.providers.*` pulls in `navconfig.logging`, whose
+# module-level init does a live socket check against LOGSTASH_HOST. In
+# offline/sandboxed environments (no route to the internal logstash host)
+# that raises `socket.gaierror` and aborts the import entirely. Only when
+# the real import fails do we substitute a minimal stand-in — in a normal
+# dev/CI environment (where the logstash host resolves or is disabled) this
+# has no effect and the real navconfig.logging module is used untouched.
+try:
+    import navconfig.logging  # noqa: F401
+except Exception:
+    _fake = types.ModuleType('navconfig.logging')
+    _fake.logging = _stdlib_logging
+    sys.modules['navconfig.logging'] = _fake
+
+from querysource.providers.default import defaultProvider  # noqa: E402
+from querysource.providers.cassandra import cassandraProvider  # noqa: E402
+from querysource.providers.abstract import BaseProvider  # noqa: E402
+from querysource.models import QueryModel  # noqa: E402
+
+
+def _slug_definition(query_raw: str, cond_definition: dict | None = None) -> QueryModel:
+    return QueryModel(
+        query_slug='test_slug',
+        query_raw=query_raw,
+        is_raw=True,
+        cond_definition=cond_definition or {},
+    )
+
+
+# ---------------------------------------------------------------------------
+# Bug 1 — cond_definition reaches the Rust validator
+# ---------------------------------------------------------------------------
+
+
+async def test_default_provider_array_hint_renders_prerendered_list():
+    """Fixture scenario from the bug report: IN ({ids}) + ARRAY hint +
+    a pre-rendered '(...)' value substitutes verbatim (unquoted)."""
+    definition = _slug_definition(
+        "SELECT * FROM t WHERE id IN ({ids})",
+        cond_definition={"ids": "ARRAY"},
+    )
+    provider = defaultProvider(
+        slug='test_slug',
+        qstype='slug',
+        definition=definition,
+        conditions={"ids": "'a','b','c'"},
+    )
+    sql = provider.raw_query(provider._query)
+    assert sql == "SELECT * FROM t WHERE id IN ('a','b','c')"
+
+
+async def test_default_provider_without_cond_definition_uses_generic_quoting():
+    """Regression: no cond_definition (default {}) behaves like before the
+    fix — a bare placeholder still falls through to generic quoting."""
+    definition = _slug_definition("SELECT * FROM t WHERE tag = {tag}")
+    provider = defaultProvider(
+        slug='test_slug',
+        qstype='slug',
+        definition=definition,
+        conditions={"tag": "hello"},
+    )
+    sql = provider.raw_query(provider._query)
+    assert sql == "SELECT * FROM t WHERE tag = 'hello'"
+
+
+async def test_cassandra_provider_also_wires_cond_definition():
+    """Cross-provider check: the same _get_cond_definition() wiring is used
+    by every provider's raw_query/get_raw_query, not just Postgres."""
+    definition = _slug_definition(
+        "SELECT * FROM t WHERE id IN ({ids})",
+        cond_definition={"ids": "array"},
+    )
+    provider = cassandraProvider(
+        slug='test_slug',
+        qstype='slug',
+        definition=definition,
+        conditions={"ids": "'a','b','c'"},
+    )
+    sql = provider.get_raw_query(provider._query)
+    assert sql == "SELECT * FROM t WHERE id IN ('a','b','c')"
+
+
+# ---------------------------------------------------------------------------
+# Bug 2 — cond_definition hints are case-insensitive
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.parametrize("hint", ["ARRAY", "array", "Array"])
+async def test_array_hint_matches_regardless_of_case(hint):
+    definition = _slug_definition(
+        "SELECT * FROM t WHERE id IN ({ids})",
+        cond_definition={"ids": hint},
+    )
+    provider = defaultProvider(
+        slug='test_slug',
+        qstype='slug',
+        definition=definition,
+        conditions={"ids": "'a','b','c'"},
+    )
+    sql = provider.raw_query(provider._query)
+    assert sql == "SELECT * FROM t WHERE id IN ('a','b','c')"
+
+
+# ---------------------------------------------------------------------------
+# Security — injection checks still run under an "array" hint
+# ---------------------------------------------------------------------------
+
+
+async def test_array_hint_does_not_bypass_injection_check():
+    definition = _slug_definition(
+        "SELECT * FROM t WHERE id IN ({ids})",
+        cond_definition={"ids": "ARRAY"},
+    )
+    provider = defaultProvider(
+        slug='test_slug',
+        qstype='slug',
+        definition=definition,
+        conditions={"ids": "'a'); DROP TABLE t;--"},
+    )
+    with pytest.raises(Exception):
+        provider.raw_query(provider._query)
+
+
+# ---------------------------------------------------------------------------
+# _get_cond_definition() helper — handles both QueryModel and plain-dict
+# definitions, and normalizes a missing/None definition to {}.
+# ---------------------------------------------------------------------------
+
+
+async def test_get_cond_definition_from_query_model():
+    definition = _slug_definition("SELECT 1", cond_definition={"x": "INTEGER"})
+    provider = defaultProvider(slug='test_slug', qstype='slug', definition=definition, conditions={})
+    assert provider._get_cond_definition() == {"x": "INTEGER"}
+
+
+class _ConcreteProvider(BaseProvider):
+    """Minimal concrete subclass — BaseProvider.query() is abstract, so it
+    can't be instantiated (even via __new__) without a real implementation.
+    Only used here to exercise _get_cond_definition() in isolation, without
+    going through __init__ (and its event-loop/parser requirements)."""
+
+    async def query(self):
+        raise NotImplementedError
+
+
+def test_get_cond_definition_from_plain_dict():
+    provider = _ConcreteProvider.__new__(_ConcreteProvider)
+    provider._definition = {"cond_definition": {"x": "STRING"}}
+    assert provider._get_cond_definition() == {"x": "STRING"}
+
+
+def test_get_cond_definition_defaults_to_empty_dict():
+    provider = _ConcreteProvider.__new__(_ConcreteProvider)
+    provider._definition = None
+    assert provider._get_cond_definition() == {}

querysource-4.5.7/querysource.egg-info/scm_version.json

@@ -1,8 +0,0 @@
-{
-  "tag": "4.5.7",
-  "distance": 0,
-  "node": "g201ef3bdd55bcfeef05ad2f110bc00d47c078f74",
-  "dirty": true,
-  "branch": "HEAD",
-  "node_date": "2026-07-02"
-}

querysource-4.5.7/rust/Cargo.toml

@@ -1,23 +0,0 @@
-[package]
-name = "qs_parsers"
-version = "0.1.0"
-edition = "2021"
-description = "Rust-based string processing for QuerySource parsers"
-
-[lib]
-name = "_qs_parsers"
-crate-type = ["cdylib"]
-
-[dependencies]
-pyo3 = { version = "0.24", features = ["extension-module"] }
-rayon = "1.10"
-regex = "1.11"
-once_cell = "1.20"
-
-[dev-dependencies]
-proptest = "1.4"
-
-[profile.release]
-opt-level = 3
-lto = true
-codegen-units = 1