sql-dialect-master 1.1.1__py3-none-any.whl

backend/utils/__init__.py

@@ -0,0 +1,2 @@
+#!/usr/bin/env python3
+"""Utility modules for SQL Dialect Master."""

backend/utils/validators.py

@@ -0,0 +1,407 @@
+#!/usr/bin/env python3
+"""Input validation utilities for SQL Dialect Master.
+
+Provides validation functions for SQL, dialects, and other inputs.
+"""
+import re
+from typing import Tuple, List
+
+from backend.core.config import SUPPORTED_DIALECTS, settings
+from backend.core.exceptions import (
+    ValidationError,
+    UnsupportedDialectError,
+    SecurityViolationError
+)
+
+
+def validate_dialect(dialect: str, param_name: str = "dialect") -> str:
+    """Validate SQL dialect.
+    
+    Args:
+        dialect: Dialect to validate
+        param_name: Parameter name for error messages
+        
+    Returns:
+        Normalized dialect name (lowercase)
+        
+    Raises:
+        UnsupportedDialectError: If dialect is not supported
+    """
+    if not dialect:
+        raise ValidationError(f"{param_name} is required", field=param_name)
+    
+    dialect_lower = dialect.lower().strip()
+    
+    if dialect_lower not in SUPPORTED_DIALECTS:
+        raise UnsupportedDialectError(dialect, SUPPORTED_DIALECTS)
+    
+    return dialect_lower
+
+
+def validate_sql(sql: str, max_length: int = None) -> str:
+    """Validate SQL input.
+    
+    Args:
+        sql: SQL to validate
+        max_length: Maximum allowed length
+        
+    Returns:
+        Validated SQL string
+        
+    Raises:
+        ValidationError: If SQL is invalid
+    """
+    if not sql:
+        raise ValidationError("SQL statement is required", field="sql")
+    
+    sql = sql.strip()
+    
+    if not sql:
+        raise ValidationError("SQL statement cannot be empty", field="sql")
+    
+    max_len = max_length or settings.transpiler_max_sql_length
+    if len(sql) > max_len:
+        raise ValidationError(
+            f"SQL exceeds maximum length of {max_len} characters",
+            field="sql",
+            value=f"{len(sql)} characters"
+        )
+    
+    return sql
+
+
+def validate_sql_security(sql: str, block_dangerous: bool = None) -> Tuple[bool, List[str]]:
+    """Validate SQL for security issues.
+    
+    Args:
+        sql: SQL to validate
+        block_dangerous: Whether to block dangerous patterns
+        
+    Returns:
+        Tuple of (is_safe, list_of_warnings)
+        
+    Raises:
+        SecurityViolationError: If dangerous pattern detected and blocking enabled
+    """
+    block = block_dangerous if block_dangerous is not None else settings.security_block_dangerous
+    warnings = []
+    
+    # Dangerous patterns that may be blocked
+    dangerous_patterns = [
+        (r";\s*(DROP|DELETE|TRUNCATE|ALTER|CREATE|INSERT|UPDATE)\s+", 
+         "Multiple statements with dangerous operations"),
+        (r"UNION\s+(ALL\s+)?SELECT\s+.*(FROM\s+information_schema|@@version|user\(\))",
+         "Potential SQL injection pattern"),
+        (r"(xp_cmdshell|sp_executesql|EXEC\s*\(|EXECUTE\s+IMMEDIATE)",
+         "Command execution attempt"),
+        (r"(INTO\s+OUTFILE|INTO\s+DUMPFILE|LOAD_FILE|UTL_FILE)",
+         "File operation detected"),
+    ]
+    
+    # Warning patterns (never blocked)
+    warning_patterns = [
+        (r"DELETE\s+FROM\s+\w+\s*(?!WHERE)", 
+         "DELETE without WHERE clause"),
+        (r"UPDATE\s+\w+\s+SET\s+.*(?!WHERE)",
+         "UPDATE without WHERE clause"),
+        (r"DROP\s+(TABLE|DATABASE|SCHEMA|INDEX|VIEW)",
+         "DROP operation - data loss risk"),
+        (r"TRUNCATE\s+TABLE",
+         "TRUNCATE operation - data loss risk"),
+    ]
+    
+    # Check dangerous patterns
+    for pattern, message in dangerous_patterns:
+        if re.search(pattern, sql, re.IGNORECASE | re.MULTILINE):
+            if block:
+                raise SecurityViolationError(message, pattern=pattern)
+            warnings.append(f"🔒 Security: {message}")
+    
+    # Check warning patterns
+    for pattern, message in warning_patterns:
+        if re.search(pattern, sql, re.IGNORECASE | re.MULTILINE):
+            warnings.append(f"⚠️ {message}")
+    
+    return len(warnings) == 0, warnings
+
+
+def validate_batch_size(size: int, max_size: int = None) -> int:
+    """Validate batch size.
+    
+    Args:
+        size: Requested batch size
+        max_size: Maximum allowed size
+        
+    Returns:
+        Validated batch size
+        
+    Raises:
+        ValidationError: If size is invalid
+    """
+    max_allowed = max_size or settings.max_batch_size
+    
+    if size <= 0:
+        raise ValidationError("Batch size must be positive", field="batch_size", value=str(size))
+    
+    if size > max_allowed:
+        return max_allowed
+    
+    return size
+
+
+def validate_type_name(type_name: str) -> str:
+    """Validate data type name.
+    
+    Args:
+        type_name: Type name to validate
+        
+    Returns:
+        Normalized type name (uppercase)
+        
+    Raises:
+        ValidationError: If type name is invalid
+    """
+    if not type_name:
+        raise ValidationError("Type name is required", field="type_name")
+    
+    return type_name.upper().strip()
+
+
+def validate_function_name(func_name: str) -> str:
+    """Validate function name.
+    
+    Args:
+        func_name: Function name to validate
+        
+    Returns:
+        Normalized function name (uppercase)
+        
+    Raises:
+        ValidationError: If function name is invalid
+    """
+    if not func_name:
+        raise ValidationError("Function name is required", field="function_name")
+    
+    return func_name.upper().strip()
+
+
+def sanitize_table_name(name: str) -> str:
+    """Sanitize table name for safe use in SQL.
+    
+    Args:
+        name: Table name to sanitize
+        
+    Returns:
+        Sanitized table name
+        
+    Raises:
+        ValidationError: If name contains invalid characters
+    """
+    if not name:
+        raise ValidationError("Table name is required", field="table_name")
+    
+    # Allow only alphanumeric, underscore, and dot (for schema.table)
+    if not re.match(r'^[a-zA-Z_][a-zA-Z0-9_\.]*$', name):
+        raise ValidationError(
+            "Table name contains invalid characters",
+            field="table_name",
+            value=name
+        )
+    
+    return name
+
+
+def sanitize_column_name(name: str) -> str:
+    """Sanitize column name for safe use in SQL.
+    
+    Args:
+        name: Column name to sanitize
+        
+    Returns:
+        Sanitized column name
+        
+    Raises:
+        ValidationError: If name is invalid
+    """
+    if not name:
+        raise ValidationError("Column name is required", field="column_name")
+    
+    if not re.match(r'^[a-zA-Z_][a-zA-Z0-9_]*$', name):
+        raise ValidationError(
+            "Column name contains invalid characters",
+            field="column_name",
+            value=name
+        )
+    
+    return name
+
+
+
+
+
+def split_sql_statements(sql: str, dialect: str = "postgres") -> list[str]:
+    """Split SQL text into individual statements, preserving original text exactly.
+
+    Pure lexical splitter — no AST parsing, no re-rendering, no semantic analysis.
+    Finds statement boundaries by tracking quote/comment states so semicolons
+    inside literals/comments are not mistaken for separators.
+
+    Handles:
+    - Single-quoted strings with escaped quotes ('')
+    - Double-quoted identifiers
+    - Backtick identifiers (MySQL)
+    - Line comments (-- comment\n)
+    - Block comments (/* ... */)
+    - PostgreSQL dollar-quoted strings ($$...$$ or $tag$...$tag$)
+    - Empty statements and trailing semicolons filtered out
+
+    Args:
+        sql: SQL text potentially containing multiple statements
+        dialect: SQL dialect hint (not used for splitting logic)
+
+    Returns:
+        List of individual SQL statement strings (original text preserved)
+    """
+    if not sql or not sql.strip():
+        return []
+
+    statements: list[str] = []
+    stmt_chars: list[str] = []
+    i = 0
+    n = len(sql)
+    in_single = False
+    in_double = False
+    in_backtick = False
+
+    # Sentinel values to distinguish "inside $$" from "not in dollar quote"
+    _IN_DOLLAR_EMPTY = object()  # inside $$...$$
+    _NOT_IN_DOLLAR = None        # not inside any dollar quote
+    dollar_tag = _NOT_IN_DOLLAR
+
+    while i < n:
+        ch = sql[i]
+
+        # ── Dollar-quoted string content ──
+        if dollar_tag is not _NOT_IN_DOLLAR:
+            # We're inside a dollar-quoted string
+            if dollar_tag is _IN_DOLLAR_EMPTY:
+                # Looking for closing $$
+                if sql[i:i+2] == "$$":
+                    stmt_chars.append("$$")
+                    i += 2
+                    dollar_tag = _NOT_IN_DOLLAR
+                else:
+                    stmt_chars.append(ch)
+                    i += 1
+                continue
+            else:
+                # Looking for closing $tag$
+                end_tag = "$" + dollar_tag + "$"
+                if sql[i:i + len(end_tag)] == end_tag:
+                    stmt_chars.append(end_tag)
+                    i += len(end_tag)
+                    dollar_tag = _NOT_IN_DOLLAR
+                else:
+                    stmt_chars.append(ch)
+                    i += 1
+                continue
+
+        # ── Start of dollar-quoted string ──
+        if ch == "$" and not in_single and not in_double and not in_backtick:
+            # Check for $$ (empty tag)
+            if i + 1 < n and sql[i + 1] == "$":
+                stmt_chars.append("$$")
+                dollar_tag = _IN_DOLLAR_EMPTY
+                i += 2
+                continue
+            # Check for $tag$ format
+            if i + 1 < n:
+                next_ch = sql[i + 1]
+                if next_ch.isalnum() or next_ch == "_":
+                    j = i + 1
+                    while j < n and sql[j] != "$":
+                        j += 1
+                    if j < n and sql[j] == "$":
+                        tag = sql[i + 1:j]
+                        if tag:
+                            # Append the opening $tag$ to preserve it
+                            stmt_chars.append("$" + tag + "$")
+                            dollar_tag = tag
+                            i = j + 1
+                            continue
+            # Not a dollar-quote start
+            stmt_chars.append(ch)
+            i += 1
+            continue
+
+        # ── Single-quoted strings ──
+        if ch == "'" and not in_double and not in_backtick:
+            if i + 1 < n and sql[i + 1] == "'":
+                stmt_chars.append("''")
+                i += 2
+                continue
+            in_single = not in_single
+            stmt_chars.append(ch)
+            i += 1
+            continue
+
+        # ── Double-quoted identifiers ──
+        if ch == '"' and not in_single and not in_backtick:
+            in_double = not in_double
+            stmt_chars.append(ch)
+            i += 1
+            continue
+
+        # ── Backtick identifiers (MySQL) ──
+        if ch == "`" and not in_single and not in_double:
+            in_backtick = not in_backtick
+            stmt_chars.append(ch)
+            i += 1
+            continue
+
+        # ── Line comments ──
+        if ch == "-" and i + 1 < n and sql[i + 1] == "-":
+            stmt_chars.append(ch)
+            i += 1
+            while i < n and sql[i] != "\n":
+                stmt_chars.append(sql[i])
+                i += 1
+            continue
+
+        # ── Block comments ──
+        if ch == "/" and i + 1 < n and sql[i + 1] == "*":
+            stmt_chars.append("/*")
+            i += 2
+            while i + 1 < n:
+                if sql[i] == "*" and sql[i + 1] == "/":
+                    stmt_chars.append("*/")
+                    i += 2
+                    break
+                stmt_chars.append(sql[i])
+                i += 1
+            else:
+                # Unterminated block comment
+                while i < n:
+                    stmt_chars.append(sql[i])
+                    i += 1
+            continue
+
+        # ── Statement terminator ──
+        if ch == ";" and not in_single and not in_double and not in_backtick:
+            statement = "".join(stmt_chars).strip()
+            if statement:
+                statements.append(statement)
+            stmt_chars = []
+            i += 1
+            continue
+
+        # ── Normal character ──
+        stmt_chars.append(ch)
+        i += 1
+
+    # Last statement without trailing semicolon
+    last = "".join(stmt_chars).strip()
+    if last:
+        statements.append(last)
+
+    return statements

frontend/__init__.py

@@ -0,0 +1,10 @@
+"""SQL Dialect Master v2 — Frontend package.
+
+Public exports for the v2 frontend architecture.
+"""
+from __future__ import annotations
+
+from frontend.core.design_tokens import DARK, LIGHT, THEMES, ColorTokens
+from frontend.core.styles import generate_css
+
+__all__ = ["DARK", "LIGHT", "THEMES", "ColorTokens", "generate_css"]

frontend/app_context_v2.py

@@ -0,0 +1,201 @@
+"""App context for SQL Dialect Master v2 — the thin adapter layer between
+frontend and backend that returns typed ViewModels instead of raw dicts.
+
+All SQL conversion goes through the canonical SQLTranspiler to ensure
+consistent security validation, stacked-statement detection, and
+post-processing behavior.
+"""
+from __future__ import annotations
+
+import logging
+
+import streamlit as st
+
+from backend.core.nl2sql import NL2SQLGenerator
+from backend.core.nl2sql_legacy import NL2SQLResult
+from backend.core.transpiler import SQLTranspiler, TranspileResult
+
+logger = logging.getLogger(__name__)
+
+# Singleton transpiler instance
+_transpiler = SQLTranspiler()
+
+
+def convert_sql(sql: str, src: str, tgt: str) -> TranspileResult:
+    """Convert SQL through the canonical SQLTranspiler.
+
+    Args:
+        sql: SQL statement to convert
+        src: Source dialect
+        tgt: Target dialect
+
+    Returns:
+        TranspileResult from the backend
+    """
+    return _transpiler.transpile(sql, src, tgt, pretty=True)
+
+
+def batch_convert_sql(
+    statements: list[str], src: str, tgt: str, pretty: bool = True
+) -> list[TranspileResult]:
+    """Batch convert multiple SQL statements.
+
+    Uses the canonical batch API which properly handles semicolons in
+    strings, comments, and dollar-quoted literals.
+
+    Args:
+        statements: List of SQL statement strings
+        src: Source dialect
+        tgt: Target dialect
+        pretty: Pretty-print output
+
+    Returns:
+        List of TranspileResult objects
+    """
+    return _transpiler.batch_transpile(statements, src, tgt, pretty=pretty)
+
+
+def format_sql_local(sql: str, dialect: str) -> str:
+    """Format SQL by round-tripping through the transpiler.
+
+    Args:
+        sql: SQL to format
+        dialect: SQL dialect
+
+    Returns:
+        Formatted SQL or original if formatting fails
+    """
+    try:
+        result = _transpiler.transpile(sql, dialect, dialect, pretty=True, validate=False)
+        if result.success:
+            return result.target_sql or sql
+        return sql
+    except Exception:  # noqa: BLE001 — transpiler already handles errors; this is a fallback
+        return sql
+
+
+def generate_nl2sql(nl: str, dialect: str, table_hint: str | None = None) -> NL2SQLResult:
+    """Generate SQL from natural language.
+
+    Args:
+        nl: Natural language description
+        dialect: Target dialect
+        table_hint: Optional table name hint
+
+    Returns:
+        NL2SQLResult from the backend
+    """
+    gen = NL2SQLGenerator(default_dialect=dialect)
+    return gen.generate(nl, dialect=dialect, table_hint=table_hint)
+
+
+def _stable_key(sql: str) -> str:
+    """Process-independent widget key (str.hash is salted per-process)."""
+    import hashlib
+
+    return f"copy_result_{hashlib.sha1(sql.encode('utf-8')).hexdigest()[:8]}"
+
+
+def _html_attr(text: str) -> str:
+    """Escape text for a double-quoted HTML attribute value."""
+    return (
+        text.replace("&", "&")
+        .replace('"', """)
+        .replace("<", "&lt;")
+        .replace(">", "&gt;")
+    )
+
+
+def copy_sql(sql: str, key: str | None = None) -> None:
+    """Copy SQL to the clipboard.
+
+    Uses Streamlit's native ``copy_button`` when available; otherwise falls
+    back to a small HTML snippet with a Web-Clipboard call so result panels
+    keep a working copy affordance.
+    """
+    if hasattr(st, "copy_button"):
+        st.copy_button("Copy", key=key or _stable_key(sql), data=sql)
+        return
+    snippet = (
+        '<div style="display:flex;justify-content:flex-end;margin:4px 0;">'
+        '<button onclick="navigator.clipboard.writeText(this.dataset.sql).then('
+        '()=>{this.textContent=\'Copied\';setTimeout(()=>this.textContent=\'Copy\',1500)})" '
+        f'data-sql="{_html_attr(sql)}" '
+        'style="padding:4px 10px;font-size:11px;cursor:pointer;">Copy</button></div>'
+    )
+    st.markdown(snippet, unsafe_allow_html=True)
+
+
+# ---------------------------------------------------------------------------
+# Static data
+# ---------------------------------------------------------------------------
+from backend.core.config import SUPPORTED_DIALECTS, get_dialect_ui_info
+from backend.utils.validators import split_sql_statements
+
+DIALECTS = SUPPORTED_DIALECTS
+DIALECT_INFO = get_dialect_ui_info()
+
+
+def get_dialect_label(dialect: str) -> str:
+    """Get formatted dialect label with icon."""
+    info = DIALECT_INFO.get(dialect, {})
+    icon = info.get("icon", "📄")
+    return f"{icon} {dialect.upper()}"
+
+
+# ---------------------------------------------------------------------------
+# Static data loading
+# ---------------------------------------------------------------------------
+import json
+from dataclasses import dataclass
+from pathlib import Path
+
+
+@dataclass(frozen=True)
+class AppData:
+    """Registry-injected static data for data-dependent pages.
+
+    The unified PageRenderer contract is ``Callable[[ColorTokens], None]`` —
+    a renderer receives only the active theme.  Pages that need static
+    data (Functions / Types) read it from this container instead of a
+    positional argument, which keeps every PAGE_MAP entry callable with
+    the same signature.
+    """
+
+    types_data: dict
+    funcs_data: dict
+
+
+_app_data: AppData | None = None
+
+
+@st.cache_data
+def load_data_v2() -> tuple[dict, dict]:
+    """Load static data (types, functions) with caching.
+
+    Returns:
+        Tuple of (types_data, funcs_data)
+    """
+    base = Path(__file__).parent.parent / "backend" / "core"
+    types_path = base / "type_mapping.json"
+    funcs_path = base / "functions_db.json"
+
+    if not types_path.exists():
+        raise FileNotFoundError(f"Missing runtime data file: {types_path}")
+    if not funcs_path.exists():
+        raise FileNotFoundError(f"Missing runtime data file: {funcs_path}")
+
+    types = json.loads(types_path.read_text(encoding="utf-8"))
+    funcs = json.loads(funcs_path.read_text(encoding="utf-8"))
+    return types, funcs
+
+
+def get_page_data() -> AppData:
+    """Return the lazily loaded static data container.
+
+    Loaded once per process; Streamlit reruns share it.
+    """
+    global _app_data
+    if _app_data is None:
+        _app_data = AppData(*load_data_v2())
+    return _app_data

frontend/core/__init__.py

@@ -0,0 +1,33 @@
+"""Shared imports for the frontend v2 architecture."""
+
+from .design_tokens import (
+    DARK,
+    LIGHT,
+    SEMANTIC_STATUS_COLOR,
+    SEMANTIC_STATUS_LABELS,
+    STATUS_ERROR,
+    STATUS_INFO,
+    STATUS_NEUTRAL,
+    STATUS_VALID,
+    STATUS_WARNING,
+    THEMES,
+    ColorTokens,
+    ThemeName,
+)
+from .styles import generate_css
+
+__all__ = [
+    "DARK",
+    "LIGHT",
+    "SEMANTIC_STATUS_COLOR",
+    "SEMANTIC_STATUS_LABELS",
+    "STATUS_ERROR",
+    "STATUS_INFO",
+    "STATUS_NEUTRAL",
+    "STATUS_VALID",
+    "STATUS_WARNING",
+    "THEMES",
+    "ColorTokens",
+    "ThemeName",
+    "generate_css",
+]