queryview 0.0.2__py3-none-any.whl

queryview/test_migrations.py

@@ -0,0 +1,99 @@
+"""Alembic owns the schema: a fresh DB must be migrated to head (all three
+tables present and stamped in alembic_version), not built by create_all."""
+
+from __future__ import annotations
+
+import asyncio
+import os
+import sqlite3
+
+from queryview.connect import _ensure_schema
+
+
+def _run(coro):
+    return asyncio.run(coro)
+
+
+def test_fresh_db_is_migrated_to_head():
+    _run(_ensure_schema())
+
+    con = sqlite3.connect(os.environ["DB_PATH"])
+    try:
+        names = {r[0] for r in con.execute("SELECT name FROM sqlite_master WHERE type='table'")}
+        # Alembic ran (not create_all): the version table exists alongside the
+        # three application tables.
+        assert {
+            "connections",
+            "predefined_queries",
+            "dashboards",
+            "workspaces",
+            "alembic_version",
+        } <= names, f"missing tables, got {sorted(names)}"
+
+        versions = [r[0] for r in con.execute("SELECT version_num FROM alembic_version")]
+    finally:
+        con.close()
+
+    assert len(versions) == 1 and versions[0], versions
+
+    # The stamped revision is the latest in the migration tree.
+    from alembic.script import ScriptDirectory
+
+    from queryview.connect import _alembic_config
+
+    head = ScriptDirectory.from_config(_alembic_config()).get_current_head()
+    assert versions[0] == head, f"stamped {versions[0]} != head {head}"
+
+
+def test_config_blob_migration_backfills_existing_clickhouse_row(tmp_path, monkeypatch):
+    """A row written at the pre-blob revision is rewrapped into an encrypted
+    JSON config that decrypts back to the original host/port/user/password.
+    Runs on a private DB: downgrading the shared session DB below the
+    workspaces revision would collide on the restored global-unique names."""
+    import json
+    import sqlite3
+
+    from alembic import command
+
+    import queryview.connect as _c
+    from queryview.connect import _alembic_config, _db_path, _decrypt_str, _encrypt_str
+
+    monkeypatch.setenv("DB_PATH", str(tmp_path / "blob.db"))
+    monkeypatch.setenv("DB_KEY_PATH", str(tmp_path / "blob.db.key"))
+    monkeypatch.setattr(_c, "_engine", None)
+    monkeypatch.setattr(_c, "_schema_ready", False)
+    monkeypatch.setattr(_c, "_key", None)
+
+    cfg = _alembic_config()
+    command.upgrade(cfg, "9a536b7c0328")  # the per-column schema, built fresh
+
+    con = sqlite3.connect(_db_path())
+    try:
+        con.execute(
+            "INSERT INTO connections (name, type, host, port, username, password, "
+            "database, last_active_at) VALUES (?,?,?,?,?,?,?,?)",
+            ("legacy", "clickhouse", "h", 8123, "u", _encrypt_str("pw"), "db", 1),
+        )
+        con.commit()
+    finally:
+        con.close()
+
+    command.upgrade(cfg, "head")
+
+    con = sqlite3.connect(_db_path())
+    try:
+        blob = con.execute("SELECT config FROM connections WHERE name='legacy'").fetchone()[0]
+    finally:
+        con.close()
+    data = json.loads(_decrypt_str(blob))
+    assert data == {"host": "h", "port": 8123, "username": "u", "password": "pw"}
+
+
+def test_predefined_queries_has_presentation_columns():
+    _run(_ensure_schema())
+    con = sqlite3.connect(os.environ["DB_PATH"])
+    try:
+        cols = {r[1] for r in con.execute("PRAGMA table_info(predefined_queries)")}
+    finally:
+        con.close()
+    assert {"order_by", "fields"} <= cols, f"missing columns, got {sorted(cols)}"

queryview/test_queries.py

@@ -0,0 +1,170 @@
+"""Tests for the predefined-queries store: cell_view round-trips through
+save/list, and workspace scoping."""
+
+from __future__ import annotations
+
+import asyncio
+
+from queryview.queries import (
+    get_predefined_query,
+    list_predefined_queries,
+    save_predefined_query,
+)
+
+
+def _run(coro):
+    return asyncio.run(coro)
+
+
+def test_save_and_list_round_trips_cell_view(default_ws_id):
+    _run(
+        save_predefined_query(
+            "cves",
+            "clickhouse",
+            "SELECT cve_id FROM t",
+            cell_view="cve_id:\n  type: link\n  value: https://nvd.nist.gov/vuln/detail/{cell}\n",
+            workspace_id=default_ws_id,
+        )
+    )
+    rows = _run(list_predefined_queries("clickhouse", default_ws_id))
+    row = next(r for r in rows if r["query_name"] == "cves")
+    assert row["query"] == "SELECT cve_id FROM t"
+    cell_view = row["cell_view"]
+    assert cell_view is not None
+    assert "nvd.nist.gov" in cell_view
+    assert "{cell}" in cell_view
+
+
+def test_save_without_cell_view_lists_as_none(default_ws_id):
+    _run(save_predefined_query("plain", "clickhouse", "SELECT 1", workspace_id=default_ws_id))
+    rows = _run(list_predefined_queries("clickhouse", default_ws_id))
+    row = next(r for r in rows if r["query_name"] == "plain")
+    assert row["cell_view"] is None
+
+
+def test_upsert_overwrites_cell_view(default_ws_id):
+    _run(
+        save_predefined_query(
+            "u",
+            "clickhouse",
+            "SELECT 1",
+            cell_view="a: {type: link, value: x}",
+            workspace_id=default_ws_id,
+        )
+    )
+    _run(
+        save_predefined_query(
+            "u",
+            "clickhouse",
+            "SELECT 1",
+            cell_view="b: {type: link, value: y}",
+            workspace_id=default_ws_id,
+        )
+    )
+    rows = _run(list_predefined_queries("clickhouse", default_ws_id))
+    row = next(r for r in rows if r["query_name"] == "u")
+    cell_view = row["cell_view"]
+    assert cell_view is not None
+    assert "b:" in cell_view
+    assert "a:" not in cell_view
+
+
+def test_clearing_cell_view_persists_null(default_ws_id):
+    _run(
+        save_predefined_query(
+            "c",
+            "clickhouse",
+            "SELECT 1",
+            cell_view="x: {type: link, value: y}",
+            workspace_id=default_ws_id,
+        )
+    )
+    _run(save_predefined_query("c", "clickhouse", "SELECT 1", cell_view=None, workspace_id=default_ws_id))
+    rows = _run(list_predefined_queries("clickhouse", default_ws_id))
+    row = next(r for r in rows if r["query_name"] == "c")
+    assert row["cell_view"] is None
+
+
+def test_order_by_and_fields_round_trip(default_ws_id):
+    _run(
+        save_predefined_query(
+            "q1",
+            "clickhouse",
+            "SELECT 1",
+            cell_view=None,
+            order_by='[{"name":"id","dir":"DESC"}]',
+            fields='["id","name"]',
+            workspace_id=default_ws_id,
+        )
+    )
+    rows = _run(list_predefined_queries("clickhouse", default_ws_id))
+    row = next(r for r in rows if r["query_name"] == "q1")
+    assert row["order_by"] == '[{"name":"id","dir":"DESC"}]'
+    assert row["fields"] == '["id","name"]'
+
+
+def test_null_presentation_is_preserved(default_ws_id):
+    _run(save_predefined_query("q2", "clickhouse", "SELECT 2", workspace_id=default_ws_id))
+    rows = _run(list_predefined_queries("clickhouse", default_ws_id))
+    row = next(r for r in rows if r["query_name"] == "q2")
+    assert row["order_by"] is None and row["fields"] is None
+
+
+def test_same_name_is_distinct_per_workspace(default_ws_id):
+    from queryview.workspaces import create_workspace, resolve
+
+    _run(create_workspace("t3-iso"))
+    other = _run(resolve("t3-iso")).id
+    _run(save_predefined_query("iso q", "clickhouse", "SELECT 1", workspace_id=default_ws_id))
+    _run(save_predefined_query("iso q", "clickhouse", "SELECT 2", workspace_id=other))
+
+    q_default = _run(get_predefined_query("clickhouse", "iso q", default_ws_id))
+    q_other = _run(get_predefined_query("clickhouse", "iso q", other))
+    assert q_default is not None and q_default["query"] == "SELECT 1"
+    assert q_other is not None and q_other["query"] == "SELECT 2"
+    names_default = [r["query_name"] for r in _run(list_predefined_queries("clickhouse", default_ws_id))]
+    names_other = [r["query_name"] for r in _run(list_predefined_queries("clickhouse", other))]
+    assert "iso q" in names_default and "iso q" in names_other
+
+
+def test_api_unknown_workspace_is_404():
+    from fastapi.testclient import TestClient
+
+    from queryview.main import app
+
+    c = TestClient(app)
+    r = c.get("/api/predefined-queries", params={"workspace": "nope-t3"})
+    assert r.status_code == 404
+
+
+def test_mcp_list_queries_parses_presentation(default_ws_id):
+    from queryview.mcp_server import list_queries
+
+    _run(
+        save_predefined_query(
+            "lq",
+            "clickhouse",
+            "SELECT 1",
+            order_by='[{"name":"id","dir":"ASC"}]',
+            fields='["id"]',
+            workspace_id=default_ws_id,
+        )
+    )
+    out = _run(list_queries("clickhouse"))
+    row = next(r for r in out["queries"] if r["query_name"] == "lq")
+    assert row["order_by"] == [{"name": "id", "dir": "ASC"}]
+    assert row["fields"] == ["id"]
+    assert row["query"] == "SELECT 1"
+
+
+def test_columns_to_rows():
+    from queryview.mcp_server import _columns_to_rows
+
+    out = _columns_to_rows({"a": ["1", "2"], "b": ["x", "y"]})
+    assert out == {"columns": ["a", "b"], "rows": [["1", "x"], ["2", "y"]]}
+
+
+def test_columns_to_rows_empty():
+    from queryview.mcp_server import _columns_to_rows
+
+    assert _columns_to_rows({}) == {"columns": [], "rows": []}

queryview/test_remote.py

@@ -0,0 +1,260 @@
+import asyncio
+import time
+
+from fastapi.testclient import TestClient
+
+from queryview import remote
+from queryview.main import app
+
+
+def test_register_returns_distinct_ids():
+    a = remote.register()
+    b = remote.register()
+    assert a and b and a != b
+    remote.unregister(a)
+    remote.unregister(b)
+
+
+def test_push_to_registered_session_delivers():
+    rid = remote.register()
+    try:
+        ok, msg = remote.push(rid, {"type": "query", "query": "SELECT 1"})
+        assert ok is True
+        msg_in = asyncio.run(remote.next_message(rid, 1.0))
+        assert msg_in == {"type": "query", "query": "SELECT 1"}
+    finally:
+        remote.unregister(rid)
+
+
+def test_push_to_unknown_session_fails():
+    ok, msg = remote.push("deadbeef", {"type": "query", "query": "SELECT 1"})
+    assert ok is False
+    assert "unknown" in msg.lower()
+
+
+def test_unregister_makes_push_fail():
+    rid = remote.register()
+    remote.unregister(rid)
+    ok, _ = remote.push(rid, {"type": "query", "query": "SELECT 1"})
+    assert ok is False
+
+
+def test_next_message_times_out_to_none():
+    rid = remote.register()
+    try:
+        assert asyncio.run(remote.next_message(rid, 0.05)) is None
+    finally:
+        remote.unregister(rid)
+
+
+def test_push_endpoint_requires_query():
+    client = TestClient(app)
+    r = client.post("/api/remote/push", json={"session_id": "x", "query": ""})
+    assert r.status_code == 400
+
+
+def test_push_endpoint_unknown_session_returns_not_delivered():
+    client = TestClient(app)
+    r = client.post(
+        "/api/remote/push",
+        json={"session_id": "deadbeef", "query": "SELECT 1"},
+    )
+    assert r.status_code == 200
+    assert r.json()["ok"] is False
+
+
+def test_push_endpoint_delivers_to_registered_session():
+
+    rid = remote.register()
+    try:
+        client = TestClient(app)
+        r = client.post(
+            "/api/remote/push",
+            json={
+                "session_id": rid,
+                "query": "SELECT id, name FROM items",
+                "limit": 5,
+                "order_by": [{"name": "id", "dir": "DESC"}],
+                "fields": ["name"],
+            },
+        )
+        assert r.json()["ok"] is True
+        msg = asyncio.run(remote.next_message(rid, 1.0))
+        assert msg is not None
+        assert msg["type"] == "query"
+        assert msg["query"] == "SELECT id, name FROM items"
+        assert msg["limit"] == 5
+        assert msg["order_by"] == [{"name": "id", "dir": "DESC"}]
+        assert msg["fields"] == ["name"]
+    finally:
+        remote.unregister(rid)
+
+
+def test_push_endpoint_forwards_cell_view():
+
+    rid = remote.register()
+    try:
+        client = TestClient(app)
+        yaml = "source:\n  type: custom\n  value: <span>{cell}</span>\n"
+        r = client.post(
+            "/api/remote/push",
+            json={"session_id": rid, "query": "SELECT 1", "cell_view": yaml},
+        )
+        assert r.json()["ok"] is True
+        msg = asyncio.run(remote.next_message(rid, 1.0))
+        assert msg is not None
+        assert msg["cell_view"] == yaml
+    finally:
+        remote.unregister(rid)
+
+
+def test_lock_endpoint_acquire_blocks_push():
+
+    rid = remote.register()
+    try:
+        client = TestClient(app)
+        r = client.post("/api/remote/lock", json={"session_id": rid, "action": "acquire"})
+        assert r.json()["ok"] is True
+        ok, msg = remote.push(rid, {"type": "query", "query": "SELECT 1"})
+        assert ok is False and msg == "blocked, user editing"
+        r = client.post("/api/remote/lock", json={"session_id": rid, "action": "release"})
+        assert r.json()["ok"] is True
+        ok, _ = remote.push(rid, {"type": "query", "query": "SELECT 1"})
+        assert ok is True
+    finally:
+        remote.unregister(rid)
+
+
+def test_lock_endpoint_bad_action_400():
+
+    rid = remote.register()
+    try:
+        client = TestClient(app)
+        r = client.post("/api/remote/lock", json={"session_id": rid, "action": "nope"})
+        assert r.status_code == 400
+    finally:
+        remote.unregister(rid)
+
+
+def test_acquire_blocks_push_then_release_allows():
+    rid = remote.register()
+    try:
+        ok, _ = remote.acquire(rid, "human")
+        assert ok is True
+        ok, msg = remote.push(rid, {"type": "query", "query": "SELECT 1"})
+        assert ok is False and msg == "blocked, user editing"
+        remote.release(rid, "human")
+        ok, msg = remote.push(rid, {"type": "query", "query": "SELECT 1"})
+        assert ok is True and msg == "delivered"
+    finally:
+        remote.unregister(rid)
+
+
+def test_lock_ttl_expiry_allows_push():
+    rid = remote.register()
+    try:
+        remote.acquire(rid, "human")
+        # Simulate the heartbeat lapsing: age the lock past its TTL.
+        remote._channels[rid].lock_touched = time.monotonic() - (remote.LOCK_TTL_SECONDS + 1)
+        ok, msg = remote.push(rid, {"type": "query", "query": "SELECT 1"})
+        assert ok is True and msg == "delivered"
+    finally:
+        remote.unregister(rid)
+
+
+def test_push_rejects_invalid_order_by():
+    rid = remote.register()
+    try:
+        ok, msg = remote.push(rid, {"type": "query", "query": "SELECT 1", "order_by": [{"name": "id", "dir": "X"}]})
+        assert ok is False and "invalid order_by" in msg
+    finally:
+        remote.unregister(rid)
+
+
+def test_push_rejects_malformed_cell_view():
+    rid = remote.register()
+    try:
+        ok, msg = remote.push(rid, {"type": "query", "query": "SELECT 1", "cell_view": "col: [unclosed"})
+        assert ok is False and "invalid cell_view" in msg
+    finally:
+        remote.unregister(rid)
+
+
+def test_release_by_nonowner_is_noop():
+    rid = remote.register()
+    try:
+        remote.acquire(rid, "human")
+        remote.release(rid, "agent")  # wrong owner: must not clear
+        ok, msg = remote.push(rid, {"type": "query", "query": "SELECT 1"})
+        assert ok is False and msg == "blocked, user editing"
+    finally:
+        remote.unregister(rid)
+
+
+def test_push_endpoint_blank_cell_view_is_none():
+
+    rid = remote.register()
+    try:
+        client = TestClient(app)
+        r = client.post(
+            "/api/remote/push",
+            json={"session_id": rid, "query": "SELECT 1", "cell_view": "   "},
+        )
+        assert r.json()["ok"] is True
+        msg = asyncio.run(remote.next_message(rid, 1.0))
+        assert msg is not None
+        assert msg["cell_view"] is None
+    finally:
+        remote.unregister(rid)
+
+
+def test_session_database_set_and_read():
+    rid = remote.register()
+    try:
+        assert remote.session_database(rid) is None
+        assert remote.set_session_database(rid, "acme_db") is True
+        assert remote.session_database(rid) == "acme_db"
+    finally:
+        remote.unregister(rid)
+
+
+def test_set_session_database_unknown_session():
+    assert remote.set_session_database("deadbeef", "x") is False
+
+
+def test_remote_db_endpoint_sets_channel_database():
+
+    rid = remote.register()
+    try:
+        client = TestClient(app)
+        r = client.post("/api/remote/db", json={"session_id": rid, "database": "d1"})
+        assert r.json()["ok"] is True
+        assert remote.session_database(rid) == "d1"
+    finally:
+        remote.unregister(rid)
+
+
+def test_push_query_return_includes_database():
+
+    from queryview.mcp_server import push_query as mcp_push_query
+
+    rid = remote.register()
+    try:
+        remote.set_session_database(rid, "acme_db")
+        out = asyncio.run(mcp_push_query(rid, "SELECT 1"))
+        assert out["ok"] is True and out["database"] == "acme_db"
+    finally:
+        remote.unregister(rid)
+
+
+def test_session_workspace_report_and_read():
+
+    rid = remote.register()
+    try:
+        assert remote.session_workspace(rid) is None
+        assert remote.set_session_workspace(rid, "team-a") is True
+        assert remote.session_workspace(rid) == "team-a"
+        assert remote.set_session_workspace("nope", "x") is False
+        assert remote.session_workspace("nope") is None
+    finally:
+        remote.unregister(rid)

queryview/test_validation.py

@@ -0,0 +1,87 @@
+from queryview.validation import MAX_LIMIT, cell_view_error, clamp_paging, presentation_error
+
+
+def test_none_inputs_are_valid():
+    assert presentation_error(None, None) is None
+
+
+def test_valid_order_by_and_fields():
+    assert presentation_error([{"name": "id", "dir": "DESC"}], ["id", "name"]) is None
+    assert presentation_error([{"name": "id", "dir": "asc"}], None) is None  # case-insensitive
+
+
+def test_bad_direction_rejected():
+    msg = presentation_error([{"name": "id", "dir": "SIDEWAYS"}], None)
+    assert msg is not None and "dir" in msg
+
+
+def test_missing_name_rejected():
+    assert presentation_error([{"dir": "ASC"}], None) is not None
+
+
+def test_backtick_in_name_rejected():
+    assert presentation_error([{"name": "a`b", "dir": "ASC"}], None) is not None
+
+
+def test_non_list_order_by_rejected():
+    assert presentation_error("id DESC", None) is not None
+
+
+def test_non_string_field_rejected():
+    assert presentation_error(None, ["ok", 3]) is not None
+    assert presentation_error(None, ["ok", ""]) is not None
+
+
+def test_cell_view_absent_or_empty_is_valid():
+    assert cell_view_error(None) is None
+    assert cell_view_error("") is None
+    assert cell_view_error("   \n") is None
+    assert cell_view_error("---\n") is None  # empty document
+
+
+def test_cell_view_valid_entries_and_params():
+    doc = (
+        "cve_id:\n"
+        "  type: link\n"
+        "  value: https://nvd.nist.gov/vuln/detail/{cell}\n"
+        "status:\n"
+        "  type: custom\n"
+        "  value: <strong>{cell}</strong>\n"
+        "params:\n"
+        "  - name: env\n"
+        "    options: [prod, staging]\n"
+        "  - name: host\n"
+        "    options_sql: SELECT DISTINCT host FROM t\n"
+    )
+    assert cell_view_error(doc) is None
+
+
+def test_cell_view_rejects_unparsable_yaml_and_non_mapping():
+    assert cell_view_error("col: [unclosed\n") is not None
+    assert cell_view_error("- a list\n") is not None
+    assert cell_view_error("just a scalar") is not None
+    assert cell_view_error(42) is not None  # not YAML text at all
+
+
+def test_cell_view_rejects_bad_entries():
+    assert cell_view_error("col: not a mapping\n") is not None
+    assert cell_view_error("col:\n  type: lnik\n  value: x\n") is not None  # typo'd type
+    assert cell_view_error("col:\n  type: link\n") is not None  # missing value
+    assert cell_view_error("col:\n  type: link\n  value: ''\n") is not None
+
+
+def test_cell_view_rejects_bad_params():
+    assert cell_view_error("params: notalist\n") is not None
+    assert cell_view_error("params:\n  - options: [a]\n") is not None  # no name
+    # options and options_sql are mutually exclusive; one is required
+    assert cell_view_error("params:\n  - name: p\n") is not None
+    assert cell_view_error("params:\n  - name: p\n    options: [a]\n    options_sql: SELECT 1\n") is not None
+    assert cell_view_error("params:\n  - name: p\n    options: []\n") is not None
+    assert cell_view_error("params:\n  - name: p\n    options: [{a: b}]\n") is not None
+
+
+def test_clamp_paging():
+    assert clamp_paging(50, 10) == (50, 10)
+    assert clamp_paging(-5, -5) == (0, 0)
+    assert clamp_paging(MAX_LIMIT + 1, 0) == (MAX_LIMIT, 0)
+    assert clamp_paging("x", None) == (100, 0)