sqlalchemy-tolap 0.1.0__py3-none-any.whl

sqlalchemy_tolap/__init__.py

@@ -0,0 +1,9 @@
+"""sqlalchemy-tolap: TOLAP policies enforced on SQLAlchemy Select statements."""
+
+from sqlalchemy_tolap.enforce import enforce
+from sqlalchemy_tolap.exceptions import TolapDenied, Uninspectable
+from sqlalchemy_tolap.pushdown import EnforcementMode
+
+__version__ = "0.1.0"
+
+__all__ = ["EnforcementMode", "TolapDenied", "Uninspectable", "enforce"]

sqlalchemy_tolap/enforce.py

@@ -0,0 +1,52 @@
+"""``enforce()``: verify, pre-check, push down, execute, post-pass. The post pass always runs."""
+
+from __future__ import annotations
+
+from typing import Any
+
+from tolap_core import SecurityContext, validate_context, validate_expiry
+
+from sqlalchemy_tolap.exceptions import TolapDenied
+from sqlalchemy_tolap.pushdown import EnforcementMode, Preparation, finalize, prepare_select
+
+
+def validate(context: SecurityContext, signing_key: str) -> None:
+    if not validate_context(context, signing_key):
+        raise TolapDenied("invalid signature")
+    expiry_reason = validate_expiry(context)
+    if expiry_reason is not None:
+        raise TolapDenied(expiry_reason)
+
+
+def dialect_name(executor: Any) -> str:
+    """The dialect of a Session, Connection or Engine."""
+    if hasattr(executor, "get_bind"):
+        return str(executor.get_bind().dialect.name)
+    if hasattr(executor, "dialect"):
+        return str(executor.dialect.name)
+    if hasattr(executor, "engine"):
+        return str(executor.engine.dialect.name)
+    raise TypeError("executor must be a Session, Connection or Engine")
+
+
+def enforce(
+    stmt: Any,
+    context: SecurityContext,
+    executor: Any,
+    *,
+    signing_key: str,
+    hash_salt: str | bytes | None = None,
+    mode: EnforcementMode | str = EnforcementMode.rewrite_and_post,
+) -> list[dict[str, Any]]:
+    """Rows of ``stmt`` the signed ``context``'s policy allows, as dicts.
+
+    ``executor`` is a Session or Connection (anything with ``execute``); the dialect it is
+    bound to decides which filters can be pushed. Raises :class:`TolapDenied` on refusal.
+    """
+    validate(context, signing_key)
+    policy = context.effective_policy
+    prep: Preparation = prepare_select(stmt, policy, dialect=dialect_name(executor), mode=mode)
+    if not prep.allowed or prep.statement is None:
+        raise TolapDenied(prep.denial_reason or "access denied")
+    rows = [dict(row) for row in executor.execute(prep.statement).mappings().all()]
+    return finalize(prep, rows, policy, hash_salt)

sqlalchemy_tolap/exceptions.py

@@ -0,0 +1,15 @@
+"""Exceptions raised by sqlalchemy-tolap. Messages carry a reason, never row data."""
+
+from __future__ import annotations
+
+
+class TolapDenied(PermissionError):
+    def __init__(self, reason: str) -> None:
+        super().__init__(f"Access denied: {reason}")
+        self.reason = reason
+
+
+class Uninspectable(TolapDenied):
+    def __init__(self, why: str) -> None:
+        super().__init__(f"query cannot be inspected: {why}")
+        self.why = why

sqlalchemy_tolap/inspect.py

@@ -0,0 +1,189 @@
+"""Determine which tables and columns a ``Select`` references, or refuse.
+
+Walks the statement's FROM list, WHERE, ORDER BY, GROUP BY, HAVING and projection with
+``sqlalchemy.sql.visitors.iterate`` (which descends into correlated subqueries and EXISTS).
+Anything opaque -- ``text()``, ``literal_column()``, unattached ``column()``, derived tables
+(subquery/CTE/lateral in FROM), set operations -- is refused: fetching less is never a risk,
+returning more is.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Iterable
+from dataclasses import dataclass
+from typing import Any
+
+from sqlalchemy import Column, Table
+from sqlalchemy.sql import visitors
+from sqlalchemy.sql.elements import ColumnClause, Label, TextClause
+from sqlalchemy.sql.selectable import Alias, CompoundSelect, FromClause, Join, Select, TextualSelect
+
+from sqlalchemy_tolap.exceptions import Uninspectable
+
+
+@dataclass(frozen=True, order=True)
+class ColRef:
+    table: str
+    name: str
+
+
+@dataclass(frozen=True)
+class Inspection:
+    root: Table
+    root_from: FromClause  # the FROM element itself: the Table, or an Alias of it
+    tables: dict[str, Table]
+    referenced: frozenset[ColRef]  # explicit references only; never a default projection
+    projected: tuple[str, ...] | None  # names in the caller's explicit projection, else None
+    selected: tuple[Any, ...]  # the selected column elements, in order
+    annotations: dict[str, frozenset[ColRef]]
+    limit: int | None
+    offset: int | None
+
+
+def canonical(table: Table) -> Table:
+    """The MetaData-registered Table (ORM and aliasing hand out annotated copies)."""
+    registered = table.metadata.tables.get(table.key)
+    return registered if registered is not None else table
+
+
+def base_table(column: Column[Any]) -> Table:
+    owner = column.table
+    if isinstance(owner, Table):
+        return canonical(owner)
+    if isinstance(owner, Alias) and isinstance(owner.element, Table):
+        return canonical(owner.element)
+    raise Uninspectable(f"column {column.name!r} belongs to a derived table")
+
+
+class _Walker:
+    def __init__(self) -> None:
+        self.refs: set[ColRef] = set()
+        self.tables: dict[str, Table] = {}
+
+    def table(self, table: Table) -> None:
+        table = canonical(table)
+        self.tables[table.name] = table
+
+    def froms(self, froms: Iterable[FromClause]) -> None:
+        for f in froms:
+            self.from_(f)
+
+    def from_(self, f: FromClause) -> None:
+        if isinstance(f, Table):
+            self.table(f)
+        elif isinstance(f, Join):
+            self.from_(f.left)
+            self.from_(f.right)
+            if f.onclause is not None:
+                self.nodes(f.onclause)
+        elif isinstance(f, Alias) and isinstance(f.element, Table):
+            self.table(f.element)
+        else:
+            raise Uninspectable(f"{type(f).__name__} in FROM is not supported")
+
+    def nodes(self, element: Any) -> None:
+        for node in visitors.iterate(element):
+            self.node(node)
+
+    def node(self, node: Any) -> None:
+        if isinstance(node, TextClause | TextualSelect | CompoundSelect):
+            raise Uninspectable(f"{type(node).__name__} is not supported")
+        if isinstance(node, Select):
+            # A nested select: its FROM list must be inspectable too (iterate does not
+            # visit FROM tables as nodes).
+            self.froms(node.get_final_froms())
+            return
+        if isinstance(node, Column):
+            table = base_table(node)
+            self.table(table)
+            self.refs.add(ColRef(table.name, node.name))
+            return
+        if isinstance(node, ColumnClause):
+            if node.is_literal and node.name == "*":
+                return  # the ``SELECT *`` inside ``exists()``; discloses nothing by itself
+            what = "literal_column()" if node.is_literal else "an unattached column()"
+            raise Uninspectable(f"{what} is not supported")
+
+
+def _entity_tables(stmt: Select[Any]) -> tuple[list[Table], int]:
+    """Tables selected whole (``select(Entity)``, ``select(table)``) and the raw column count."""
+    raw = list(stmt._raw_columns)
+    tables: list[Table] = []
+    for rc in raw:
+        if isinstance(rc, Table):
+            tables.append(canonical(rc))
+        elif isinstance(rc, Alias) and isinstance(rc.element, Table):
+            tables.append(canonical(rc.element))
+    return tables, len(raw)
+
+
+def inspect(stmt: Any) -> Inspection:
+    if not isinstance(stmt, Select):
+        raise Uninspectable(f"{type(stmt).__name__} is not a Select")
+    walker = _Walker()
+    froms = stmt.get_final_froms()
+    if not froms:
+        raise Uninspectable("statement has no FROM")
+    walker.froms(froms)
+    root_from: FromClause = froms[0]
+    while isinstance(root_from, Join):
+        root_from = root_from.left
+    if isinstance(root_from, Table):
+        root = canonical(root_from)
+    elif isinstance(root_from, Alias) and isinstance(root_from.element, Table):
+        root = canonical(root_from.element)
+    else:
+        raise Uninspectable(f"{type(root_from).__name__} as the root FROM is not supported")
+
+    if stmt.whereclause is not None:
+        walker.nodes(stmt.whereclause)
+    for clause in (*stmt._order_by_clauses, *stmt._group_by_clauses, *stmt._having_criteria):
+        walker.nodes(clause)
+
+    # Projection: an entity/table select is a default projection (checked at prepare time,
+    # like SELECT *); named columns and labelled expressions are explicit references.
+    entity_tables, raw_count = _entity_tables(stmt)
+    explicit = not entity_tables
+    if entity_tables and raw_count != len(entity_tables):
+        raise Uninspectable("mixing an entity with columns in the projection is not supported")
+    if entity_tables and any(t is not root for t in entity_tables):
+        raise Uninspectable("projection of an entity other than the root table is not supported")
+
+    selected = tuple(stmt.selected_columns)
+    projected: list[str] = []
+    annotations: dict[str, frozenset[ColRef]] = {}
+    if explicit:
+        for col in selected:
+            if isinstance(col, Column):
+                table = base_table(col)
+                if table is not root:
+                    raise Uninspectable(
+                        f"projection of {table.name}.{col.name} is not a root-table column"
+                    )
+                walker.refs.add(ColRef(table.name, col.name))
+                projected.append(col.name)
+            elif isinstance(col, Label):
+                if col.name in root.columns:
+                    # A row filter on that column would otherwise be evaluated against the
+                    # label's value in the post pass. Django refuses the same shadowing.
+                    raise Uninspectable(f"label {col.name!r} shadows a column of {root.name}")
+                sub = _Walker()
+                sub.tables = walker.tables
+                sub.nodes(col.element)
+                walker.refs |= sub.refs
+                annotations[col.name] = frozenset(sub.refs)
+                projected.append(col.name)
+            else:
+                raise Uninspectable("an unlabelled expression in the projection is not supported")
+
+    return Inspection(
+        root=root,
+        root_from=root_from,
+        tables=dict(walker.tables),
+        referenced=frozenset(walker.refs),
+        projected=tuple(projected) if explicit else None,
+        selected=selected,
+        annotations=annotations,
+        limit=stmt._limit,
+        offset=stmt._offset,
+    )

sqlalchemy_tolap/matching.py

@@ -0,0 +1,46 @@
+"""Field and object name matching with upstream's semantics (connector spec section 3).
+
+Mirrors ``tolap_core.enforcement._pattern_matches`` and ``_field_name_matches``, which are
+private upstream. They are reproduced here (not imported) so a refactor upstream cannot
+silently change our pre-execution decisions; ``tests/sqlalchemy/test_matching.py`` asserts parity
+against the upstream functions on a corpus so drift is caught instead.
+
+Rules: ``*`` and ``?`` are the only metacharacters, brackets are literal, matching is
+case-insensitive and platform-independent, and a field reference may be bare (``ssn``) or
+qualified (``patients.ssn``) on either side.
+"""
+
+from __future__ import annotations
+
+from fnmatch import fnmatchcase
+
+
+def _literal_brackets(pattern: str) -> str:
+    return pattern.replace("[", "[[]")
+
+
+def object_matches(pattern: str, name: str) -> bool:
+    """Case-insensitive glob over the whole name, brackets literal."""
+    return fnmatchcase(name.lower(), _literal_brackets(pattern).lower())
+
+
+def _forms(name: str) -> set[str]:
+    lowered = name.lower()
+    forms = {lowered}
+    if "." in lowered:
+        forms.add(lowered.split(".", 1)[1])
+        forms.add(lowered.rsplit(".", 1)[1])
+    return forms
+
+
+def field_matches(rule: str, key: str) -> bool:
+    """Whether a policy field reference refers to a record key, either side qualified."""
+    return any(
+        fnmatchcase(key_form, _literal_brackets(rule_form))
+        for rule_form in _forms(rule)
+        for key_form in _forms(key)
+    )
+
+
+def is_pattern(name: str) -> bool:
+    return "*" in name or "?" in name

sqlalchemy_tolap/precheck.py

@@ -0,0 +1,56 @@
+"""Pre-execution checks (connector spec section 5), same order and reasons as django-tolap."""
+
+from __future__ import annotations
+
+from typing import Any
+
+from tolap_core import AccessResult, EffectivePolicy, validate_access
+
+from sqlalchemy_tolap.exceptions import Uninspectable
+from sqlalchemy_tolap.inspect import Inspection, inspect
+from sqlalchemy_tolap.rules import FieldRules, field_visible, is_masked, unknown_fields
+
+UNKNOWN_FIELD = "policy references unknown field: {name}"
+FIELD_DENIED = "denied fields: {names}"
+MASKED_ANNOTATION = "annotation exposes masked field: {name}"
+CANNOT_INSPECT = "query cannot be inspected: {why}"
+
+
+def field_denied(names: list[str]) -> str:
+    return FIELD_DENIED.format(names=", ".join(names))
+
+
+def precheck_inspection(ins: Inspection, policy: EffectivePolicy) -> AccessResult:
+    if not policy.permissions.can_query:
+        return AccessResult(allowed=False, reason="query not permitted")
+    root_access = validate_access(ins.root.name, policy)
+    if not root_access.allowed:
+        return root_access
+    for name in sorted(n for n in ins.tables if n != ins.root.name):
+        access = validate_access(name, policy)
+        if not access.allowed:
+            return access
+    rules = FieldRules.of(policy)
+    unknown = unknown_fields(ins.root, rules)
+    if unknown:
+        return AccessResult(allowed=False, reason=UNKNOWN_FIELD.format(name=unknown[0]))
+    denied = sorted(
+        f"{r.table}.{r.name}"
+        for r in ins.referenced
+        if not field_visible(rules, f"{r.table}.{r.name}")
+    )
+    if denied:
+        return AccessResult(allowed=False, reason=field_denied(denied))
+    for label, sources in sorted(ins.annotations.items()):
+        for ref in sorted(sources):
+            if is_masked(rules, f"{ref.table}.{ref.name}"):
+                return AccessResult(allowed=False, reason=MASKED_ANNOTATION.format(name=label))
+    return AccessResult(allowed=True)
+
+
+def precheck(stmt: Any, policy: EffectivePolicy) -> AccessResult:
+    try:
+        ins = inspect(stmt)
+    except Uninspectable as exc:
+        return AccessResult(allowed=False, reason=CANNOT_INSPECT.format(why=exc.why))
+    return precheck_inspection(ins, policy)

sqlalchemy_tolap/pushdown.py

@@ -0,0 +1,317 @@
+"""Compile TOLAP row filters into SQLAlchemy criteria, or decline; prepare a whole Select.
+
+Same contract and semantics as ``django_tolap.pushdown`` (a pushed predicate selects exactly
+the rows upstream's post pass keeps, on this dialect). Unlike Django's ORM, SQLAlchemy does
+not add a null arm to negations, so ``notEquals``/``notIn``/``notLike`` are rendered as
+``(col <> x OR col IS NULL)`` here, as upstream's own rewriter does.
+"""
+
+from __future__ import annotations
+
+import logging
+from dataclasses import dataclass
+from dataclasses import field as dataclass_field
+from enum import Enum
+from typing import Any, Literal
+
+from sqlalchemy import Column, Table, and_, false, or_, true
+from sqlalchemy import types as sa_types
+from sqlalchemy.sql.elements import ColumnElement
+from sqlalchemy.sql.selectable import Select
+from tolap_core import EffectivePolicy, FilterOperator, RowFilter, apply_result_pipeline
+
+from sqlalchemy_tolap.exceptions import Uninspectable
+from sqlalchemy_tolap.inspect import inspect
+from sqlalchemy_tolap.precheck import CANNOT_INSPECT, precheck_inspection
+from sqlalchemy_tolap.rules import FieldRules, field_visible
+
+_LOG = logging.getLogger(__name__)
+
+Kind = Literal["str", "int", "float", "bool", "other"]
+NEVER_PUSHED = frozenset(
+    {FilterOperator.contains, FilterOperator.starts_with, FilterOperator.matches}
+)
+MAX_LIKE_PATTERN_LENGTH = 1024
+
+
+class EnforcementMode(Enum):
+    rewrite_and_post = "rewriteAndPost"
+    post_only = "postOnly"
+
+
+@dataclass(frozen=True)
+class DialectRules:
+    string_equality: bool
+    string_order: bool
+    like: bool
+
+
+DIALECTS: dict[str, DialectRules] = {
+    "postgresql": DialectRules(string_equality=True, string_order=False, like=True),
+    "sqlite": DialectRules(string_equality=True, string_order=True, like=False),
+    "mysql": DialectRules(string_equality=False, string_order=False, like=False),
+    "mariadb": DialectRules(string_equality=False, string_order=False, like=False),
+    "oracle": DialectRules(string_equality=False, string_order=False, like=False),
+    "mssql": DialectRules(string_equality=False, string_order=False, like=False),
+}
+_warned: set[str] = set()
+
+
+def dialect_rules(name: str) -> DialectRules | None:
+    rules = DIALECTS.get(name)
+    if rules is None and name not in _warned:
+        _warned.add(name)
+        _LOG.warning("TOLAP pushdown disabled: unknown dialect %r", name)
+    return rules
+
+
+def column_kind(column: Column[Any]) -> Kind:
+    t = column.type
+    if isinstance(t, sa_types.Boolean):
+        return "bool"
+    if isinstance(t, sa_types.String):
+        return "str"
+    if isinstance(t, sa_types.Integer):
+        return "int"
+    if isinstance(t, sa_types.Float):
+        return "float"
+    return "other"
+
+
+def value_fits(kind: Kind, value: Any) -> bool:
+    if isinstance(value, bool):
+        return kind == "bool"
+    if kind == "str":
+        return isinstance(value, str)
+    if kind == "int":
+        return isinstance(value, int)
+    if kind == "float":
+        return isinstance(value, int | float)
+    return False
+
+
+def resolve_column(rf: RowFilter, table: Table) -> Column[Any] | None:
+    qualifier, _, leaf = rf.field.rpartition(".")
+    if qualifier and qualifier.lower() != table.name.lower():
+        return None
+    for column in table.columns:
+        if column.name.lower() == leaf.lower():
+            return column
+    return None
+
+
+def _nothing() -> ColumnElement[bool]:
+    return false()
+
+
+_ORDERING = {
+    FilterOperator.greater_than: "__gt__",
+    FilterOperator.greater_than_or_equal: "__ge__",
+    FilterOperator.less_than: "__lt__",
+    FilterOperator.less_than_or_equal: "__le__",
+}
+
+
+def compile_filter(
+    rf: RowFilter, table: Table, dialect: str, *, source: Any = None
+) -> ColumnElement[bool] | None:
+    """Criteria for ``rf`` on ``table``'s column, taken from ``source`` (an alias) if given."""
+    rules = dialect_rules(dialect)
+    if rules is None or rf.operator in NEVER_PUSHED:
+        return None
+    resolved = resolve_column(rf, table)
+    if resolved is None or resolved.foreign_keys:
+        return None
+    col: Column[Any] = source.c[resolved.name] if source is not None else resolved
+    op = rf.operator
+    if op is FilterOperator.is_null:
+        return col.is_(None)
+    if op is FilterOperator.is_not_null:
+        return col.is_not(None)
+
+    kind = column_kind(col)
+    if kind == "other":
+        return None
+    if kind == "str" and getattr(col.type, "collation", None):
+        return None
+
+    if op in (FilterOperator.equals, FilterOperator.not_equals):
+        negated = op is FilterOperator.not_equals
+        if rf.value is None:
+            return col.is_not(None) if negated else col.is_(None)
+        if not value_fits(kind, rf.value) or (kind == "str" and not rules.string_equality):
+            return None
+        return or_(col != rf.value, col.is_(None)) if negated else col == rf.value
+
+    if op in (FilterOperator.in_, FilterOperator.not_in):
+        values = list(rf.values or [])
+        has_null = any(v is None for v in values)
+        members = [v for v in values if v is not None]
+        if any(not value_fits(kind, v) for v in members):
+            return None
+        if kind == "str" and members and not rules.string_equality:
+            return None
+        if op is FilterOperator.in_:
+            if not values:
+                return _nothing()
+            crit = col.in_(members) if members else _nothing()
+            return or_(crit, col.is_(None)) if has_null else crit
+        if not values:
+            return true()
+        crit = col.not_in(members) if members else true()
+        return and_(crit, col.is_not(None)) if has_null else or_(crit, col.is_(None))
+
+    if op in _ORDERING:
+        if rf.value is None:
+            return _nothing()
+        if not value_fits(kind, rf.value) or kind == "bool":
+            return None
+        if kind == "str" and not rules.string_order:
+            return None
+        result: ColumnElement[bool] = getattr(col, _ORDERING[op])(rf.value)
+        return result
+
+    if op is FilterOperator.between:
+        bounds = list(rf.values or [])
+        if len(bounds) < 2 or bounds[0] is None or bounds[1] is None:
+            return _nothing()
+        if kind == "bool" or not all(value_fits(kind, b) for b in bounds[:2]):
+            return None
+        if kind == "str" and not rules.string_order:
+            return None
+        return col.between(bounds[0], bounds[1])
+
+    if op in (FilterOperator.like, FilterOperator.not_like):
+        if kind != "str" or not rules.like or not isinstance(rf.value, str):
+            return None
+        if len(rf.value) > MAX_LIKE_PATTERN_LENGTH:
+            return None
+        if op is FilterOperator.like:
+            return col.like(rf.value, escape="\\")
+        return or_(col.not_like(rf.value, escape="\\"), col.is_(None))
+
+    return None  # pragma: no cover
+
+
+NO_FIELDS_VISIBLE = "no fields visible"
+
+
+@dataclass
+class Preparation:
+    allowed: bool
+    statement: Select[Any] | None
+    denial_reason: str | None = None
+    unpushable_filters: list[RowFilter] = dataclass_field(default_factory=list)
+    pushed_filters: list[RowFilter] = dataclass_field(default_factory=list)
+    visible_fields: tuple[str, ...] = ()
+    projection: tuple[str, ...] = ()
+    extra_fields: tuple[str, ...] = ()
+    max_results: int | None = None
+    mode: EnforcementMode = EnforcementMode.rewrite_and_post
+
+    @property
+    def fully_pushed_down(self) -> bool:
+        return self.allowed and not self.unpushable_filters
+
+    @classmethod
+    def denied(cls, reason: str) -> Preparation:
+        return cls(allowed=False, statement=None, denial_reason=reason)
+
+
+def prepare_select(
+    stmt: Any,
+    policy: EffectivePolicy,
+    *,
+    dialect: str,
+    mode: EnforcementMode | str = EnforcementMode.rewrite_and_post,
+) -> Preparation:
+    """Pre-check, then push filters, projection and limit into a new Select."""
+    resolved_mode = EnforcementMode(mode) if isinstance(mode, str) else mode
+    try:
+        ins = inspect(stmt)
+    except Uninspectable as exc:
+        return Preparation.denied(CANNOT_INSPECT.format(why=exc.why))
+    access = precheck_inspection(ins, policy)
+    if not access.allowed:
+        return Preparation.denied(access.reason or "access denied")
+
+    root = ins.root
+    rules = FieldRules.of(policy)
+    by_name = {c.name: ins.root_from.c[c.name] for c in root.columns}  # alias-aware
+    visible = tuple(c.name for c in root.columns if field_visible(rules, f"{root.name}.{c.name}"))
+
+    if ins.projected is None:
+        base: list[Any] = [by_name[n] for n in visible]
+        names = list(visible)
+    else:
+        base = []
+        names = []
+        for col in ins.selected:
+            if isinstance(col, Column):
+                if col.name in visible:
+                    base.append(col)
+                    names.append(col.name)
+            else:  # a Label already checked by the pre-check
+                base.append(col)
+                names.append(col.name)
+    if not base:
+        return Preparation.denied(NO_FIELDS_VISIBLE)
+
+    row_filters = list(policy.object_rules.row_filters or ()) if policy.object_rules else []
+    extra: list[str] = []
+    for rf in row_filters:
+        col = resolve_column(rf, root)
+        if col is not None and col.name not in names and col.name not in extra:
+            extra.append(col.name)
+    for name in extra:
+        base.append(by_name[name])
+
+    sliced = ins.limit is not None or ins.offset is not None
+    push = resolved_mode is EnforcementMode.rewrite_and_post and not sliced
+    pushed: list[RowFilter] = []
+    unpushable: list[RowFilter] = []
+    prepared: Select[Any] = stmt
+    for rf in row_filters:
+        crit = compile_filter(rf, root, dialect, source=ins.root_from) if push else None
+        if crit is None:
+            unpushable.append(rf)
+        else:
+            pushed.append(rf)
+            prepared = prepared.where(crit)
+
+    prepared = prepared.with_only_columns(*base, maintain_column_froms=True)
+
+    # The limit is pushed only when every row filter was pushed (see django_tolap.pushdown).
+    max_results = policy.limits.max_results if policy.limits else None
+    if (
+        max_results is not None
+        and resolved_mode is EnforcementMode.rewrite_and_post
+        and not unpushable
+    ):
+        if ins.limit is None or max_results < ins.limit:
+            prepared = prepared.limit(max_results)
+
+    return Preparation(
+        allowed=True,
+        statement=prepared,
+        unpushable_filters=unpushable,
+        pushed_filters=pushed,
+        visible_fields=visible,
+        projection=(*names, *extra),
+        extra_fields=tuple(extra),
+        max_results=max_results,
+        mode=resolved_mode,
+    )
+
+
+def finalize(
+    prep: Preparation,
+    rows: list[dict[str, Any]],
+    policy: EffectivePolicy,
+    hash_salt: str | bytes | None,
+) -> list[dict[str, Any]]:
+    result: list[dict[str, Any]] = apply_result_pipeline(rows, policy, hash_salt)
+    if not prep.extra_fields:
+        return result
+    extra = set(prep.extra_fields)
+    return [{k: v for k, v in row.items() if k not in extra} for row in result]

sqlalchemy_tolap/rules.py

@@ -0,0 +1,61 @@
+"""Field-rule helpers shared by the pre-check and the projection (mirrors django_tolap.precheck)."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+from sqlalchemy import Table
+from tolap_core import EffectivePolicy, PolicyDefinition
+
+from sqlalchemy_tolap.matching import field_matches, is_pattern
+
+
+@dataclass(frozen=True)
+class FieldRules:
+    hidden: tuple[str, ...]
+    allowed: tuple[str, ...] | None
+    masked: tuple[str, ...]
+    filtered: tuple[str, ...]
+
+    @classmethod
+    def of(cls, policy: EffectivePolicy | PolicyDefinition) -> FieldRules:
+        rules = policy.object_rules
+        fr = rules.field_rules if rules else None
+        return cls(
+            hidden=tuple(fr.hidden_fields or ()) if fr else (),
+            allowed=tuple(fr.allowed_fields) if fr and fr.allowed_fields is not None else None,
+            masked=tuple(m.field for m in (fr.masked_fields or ())) if fr else (),
+            filtered=tuple(f.field for f in (rules.row_filters or ())) if rules else (),
+        )
+
+
+def is_hidden(rules: FieldRules, key: str) -> bool:
+    return any(field_matches(rule, key) for rule in rules.hidden)
+
+
+def is_allowed(rules: FieldRules, key: str) -> bool:
+    return rules.allowed is None or any(field_matches(rule, key) for rule in rules.allowed)
+
+
+def is_masked(rules: FieldRules, key: str) -> bool:
+    return any(field_matches(rule, key) for rule in rules.masked)
+
+
+def field_visible(rules: FieldRules, key: str) -> bool:
+    return not is_hidden(rules, key) and is_allowed(rules, key)
+
+
+def unknown_fields(table: Table, rules: FieldRules) -> list[str]:
+    """Policy field names that must exist on ``table`` but do not (bare or table-qualified)."""
+    obj = table.name.lower()
+    columns = {c.name.lower() for c in table.columns}
+    unknown: list[str] = []
+    for name in (*rules.filtered, *rules.hidden, *(rules.allowed or ()), *rules.masked):
+        if is_pattern(name):
+            continue
+        qualifier, _, leaf = name.rpartition(".")
+        if qualifier and qualifier.lower() != obj:
+            continue
+        if leaf.lower() not in columns:
+            unknown.append(name)
+    return unknown

sqlalchemy_tolap-0.1.0.dist-info/METADATA

@@ -0,0 +1,78 @@
+Metadata-Version: 2.5
+Name: sqlalchemy-tolap
+Version: 0.1.0
+Summary: TOLAP policies enforced on SQLAlchemy Select statements with ORM-native pushdown
+Project-URL: Homepage, https://github.com/smhasan94/django-tolap
+Project-URL: Issues, https://github.com/smhasan94/django-tolap/issues
+Project-URL: Changelog, https://github.com/smhasan94/django-tolap/blob/main/CHANGELOG.md
+Author: Sharukh Hasan
+License-Expression: Apache-2.0
+License-File: LICENSE
+License-File: NOTICE
+Keywords: access-control,ai-agents,mcp,sqlalchemy,tolap
+Classifier: Development Status :: 3 - Alpha
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Database
+Classifier: Topic :: Security
+Requires-Python: >=3.11
+Requires-Dist: sqlalchemy<2.2,>=2.0
+Requires-Dist: tolap-core<2,>=1.0
+Description-Content-Type: text/markdown
+
+# sqlalchemy-tolap
+
+**TOLAP policies enforced on SQLAlchemy `Select` statements with ORM-native pushdown.**
+
+[TOLAP](https://github.com/awslabs/tolap) (Tool-Object Level Access Protocol, AWS,
+Apache-2.0) decides what an AI agent's tool may *return*: which tables, columns and rows,
+how fields are masked, how many results. `sqlalchemy-tolap` enforces a signed TOLAP
+context on a SQLAlchemy 2.x `Select` before it runs, and applies TOLAP's own
+post-execution pass afterwards.
+
+- **Pre-execution checks.** Signature and expiry, `canQuery`, object access for every table
+  in the statement, referenced columns against hidden and allowed sets. Refuses rather than
+  narrows.
+- **Pushdown.** Row filters become `WHERE` clauses, the result limit a `LIMIT`, hidden
+  columns leave the projection. Only where the dialect's semantics match TOLAP's; anything
+  else is left to the post pass and reported, never approximated.
+- **Differential proof.** Pushdown plus post pass returns the same rows as post pass alone,
+  on SQLite and PostgreSQL, against upstream's fixtures and a Hypothesis property.
+
+## Install
+
+```bash
+pip install sqlalchemy-tolap
+```
+
+Python 3.11+, SQLAlchemy 2.0 or 2.1. Pulls `tolap-core` from PyPI.
+
+## Usage
+
+```python
+from sqlalchemy import select
+from sqlalchemy_tolap import enforce
+
+rows = enforce(
+    select(Patient).where(Patient.full_name.ilike(f"%{q}%")),
+    context,            # a signed TOLAP SecurityContext from wherever you resolve policies
+    session,            # Session or Connection; its dialect decides what can be pushed
+    signing_key=KEY,
+)
+```
+
+Entity selects (`select(Patient)`) are the default projection; named columns and labels are
+explicit references. `text()`, `literal_column()`, derived tables in `FROM` and set
+operations are refused. `enforce(..., mode="postOnly")` skips the pushdown but not the
+checks or the post pass.
+
+Design notes, the vendor rules and the gap measurement against upstream's string rewriter
+are in the [repository README](https://github.com/smhasan94/django-tolap#readme).
+
+## License
+
+Apache-2.0. Not affiliated with AWS; TOLAP is their project.

sqlalchemy_tolap-0.1.0.dist-info/RECORD

@@ -0,0 +1,14 @@
+sqlalchemy_tolap/__init__.py,sha256=a1-sAXXApDPwUTI0Tfr-LsTFzO76Ovmwt7QuBvQjeyU,345
+sqlalchemy_tolap/enforce.py,sha256=fXVhDxFc-hHAHBwaNFrB0sWPYa9D-46v6Cwsnt8S0HU,2021
+sqlalchemy_tolap/exceptions.py,sha256=IwbmIZ73LXaIBeb-5lLGU3FM4xxS5izyuX4CfFIfzhM,450
+sqlalchemy_tolap/inspect.py,sha256=S4b2fegzULWluXc8DVl1FfI4GxaaUWnagTYEXy2F1Wo,7525
+sqlalchemy_tolap/matching.py,sha256=xgpAl2qKZc73URnoUbgk1v3RLhpPQ50LTufweMYgmeM,1602
+sqlalchemy_tolap/precheck.py,sha256=Zne21vDMSsSBO96lhpuszDf2ezUnpsJg-P6447GuyiU,2204
+sqlalchemy_tolap/pushdown.py,sha256=wKG9mAgxysaHa663pgfa5Lm4EpjfNoSFi4-49WMMGgc,11155
+sqlalchemy_tolap/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+sqlalchemy_tolap/rules.py,sha256=YoXUCIRRFeB730ng7q5sJUZtHVLDDBPwO_JoMvNmrKY,2168
+sqlalchemy_tolap-0.1.0.dist-info/METADATA,sha256=79t0lQ-t4-3HVM_yIGvaYWKNhOumKroKVNF48nVrum4,3202
+sqlalchemy_tolap-0.1.0.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
+sqlalchemy_tolap-0.1.0.dist-info/licenses/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
+sqlalchemy_tolap-0.1.0.dist-info/licenses/NOTICE,sha256=b10n5cIJ_Vv5hGX1aqgZkRbTgztvt6Tdb9PEuwFko7o,348
+sqlalchemy_tolap-0.1.0.dist-info/RECORD,,

sqlalchemy_tolap-0.1.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.32.4
+Root-Is-Purelib: true
+Tag: py3-none-any

sqlalchemy_tolap-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

sqlalchemy_tolap-0.1.0.dist-info/licenses/NOTICE

@@ -0,0 +1,7 @@
+django-tolap and sqlalchemy-tolap
+Copyright 2026 Sharukh Hasan
+
+Adapters for TOLAP (Tool-Object Level Access Protocol), https://github.com/awslabs/tolap,
+Copyright Amazon.com, Inc. or its affiliates, licensed under the Apache License 2.0.
+This project depends on the published tolap-core and tolap-store packages and does not
+include their source.