t-sql 2.0.0__tar.gz → 2.1.2__tar.gz

{t_sql-2.0.0 → t_sql-2.1.2}/PKG-INFO

@@ -1,10 +1,11 @@
 Metadata-Version: 2.4
 Name: t-sql
-Version: 2.0.0
+Version: 2.1.2
 Summary: Safe SQL. SQL queries for python t-strings (PEP 750)
 Project-URL: Homepage, https://github.com/nhumrich/t-sql
 License-File: LICENSE
 Requires-Python: >=3.14
+Requires-Dist: alembic>=1.17.0
 Description-Content-Type: text/markdown
 
 # t-sql

{t_sql-2.0.0 → t_sql-2.1.2}/context7.json

@@ -1,4 +1,8 @@
 {
+  "$schema": "https://context7.com/schema/context7.json",
+  "projectTitle": "t-sql",
+  "description": "t-sql is a lightweight SQL templating library for Python 3.14+ that leverages t-strings to safely build SQL queries, preventing injection attacks, and includes a query builder and SQLAlchemy integration.",
+  "branch": "main",
   "excludeFolders": [
     "tests",
     ".github",
@@ -22,5 +26,11 @@
     "When mixing query builder with t-strings using .where(), t-string conditions are automatically wrapped in parentheses for proper operator precedence.",
     "The @table decorator returns an instance - use the decorated class directly, don't instantiate it.",
     "Default parameter style is QMARK (?). Use tsql.styles.NUMERIC_DOLLAR for PostgreSQL ($1, $2), or other styles as needed."
+  ],
+  "previousVersions": [
+    {
+      "tag": "v1_2_1",
+      "title": "v1.2.1"
+    }
   ]
 }

{t_sql-2.0.0 → t_sql-2.1.2}/pyproject.toml

@@ -4,11 +4,13 @@ build-backend = "hatchling.build"
 
 [project]
 name = "t-sql"
-version = "2.0.0"
+version = "2.1.2"
 description = "Safe SQL. SQL queries for python t-strings (PEP 750)"
 readme = "README.md"
 requires-python = ">=3.14"
-dependencies = []
+dependencies = [
+    "alembic>=1.17.0",
+]
 
 [project.urls]
 Homepage = "https://github.com/nhumrich/t-sql"

t_sql-2.1.2/tests/test_alembic_integration.py

@@ -0,0 +1,363 @@
+import tempfile
+import shutil
+from pathlib import Path
+from textwrap import dedent
+import re
+
+import pytest
+from sqlalchemy import MetaData, Column, String, Integer, Boolean, ForeignKey, TIMESTAMP, create_engine
+from sqlalchemy.dialects.postgresql import JSONB
+from alembic.config import Config
+from alembic.script import ScriptDirectory
+from alembic.runtime.migration import MigrationContext
+from alembic.autogenerate import compare_metadata
+
+from tsql.query_builder import Table
+
+
+@pytest.fixture
+def temp_alembic_env():
+    temp_dir = tempfile.mkdtemp()
+    alembic_dir = Path(temp_dir) / "alembic"
+    alembic_dir.mkdir()
+    versions_dir = alembic_dir / "versions"
+    versions_dir.mkdir()
+
+    env_py = alembic_dir / "env.py"
+    env_py.write_text(dedent("""
+        from alembic import context
+        from sqlalchemy import engine_from_config, pool
+
+        config = context.config
+        target_metadata = config.attributes.get('target_metadata', None)
+
+        def run_migrations_offline():
+            context.configure(
+                url=config.get_main_option("sqlalchemy.url"),
+                target_metadata=target_metadata,
+                literal_binds=True,
+                dialect_opts={"paramstyle": "named"},
+            )
+            with context.begin_transaction():
+                context.run_migrations()
+
+        def run_migrations_online():
+            connectable = config.attributes.get('connection', None)
+            if connectable is None:
+                connectable = engine_from_config(
+                    config.get_section(config.config_ini_section),
+                    prefix="sqlalchemy.",
+                    poolclass=pool.NullPool,
+                )
+
+            with connectable.connect() as connection:
+                context.configure(
+                    connection=connection,
+                    target_metadata=target_metadata
+                )
+                with context.begin_transaction():
+                    context.run_migrations()
+
+        if context.is_offline_mode():
+            run_migrations_offline()
+        else:
+            run_migrations_online()
+    """))
+
+    script_py = alembic_dir / "script.py.mako"
+    script_py.write_text(dedent('''
+        """${message}"""
+        from alembic import op
+        import sqlalchemy as sa
+        ${imports if imports else ""}
+
+        revision = ${repr(up_revision)}
+        down_revision = ${repr(down_revision)}
+        branch_labels = ${repr(branch_labels)}
+        depends_on = ${repr(depends_on)}
+
+        def upgrade():
+            ${upgrades if upgrades else "pass"}
+
+        def downgrade():
+            ${downgrades if downgrades else "pass"}
+    '''))
+
+    alembic_ini = Path(temp_dir) / "alembic.ini"
+    alembic_ini.write_text(dedent(f"""
+        [alembic]
+        script_location = {alembic_dir}
+        sqlalchemy.url = sqlite:///:memory:
+
+        [loggers]
+        keys = root
+
+        [handlers]
+        keys = console
+
+        [formatters]
+        keys = generic
+
+        [logger_root]
+        level = WARN
+        handlers = console
+
+        [handler_console]
+        class = StreamHandler
+        args = (sys.stderr,)
+        level = NOTSET
+        formatter = generic
+
+        [formatter_generic]
+        format = %(levelname)-5.5s [%(name)s] %(message)s
+    """))
+
+    yield temp_dir, alembic_ini
+
+    shutil.rmtree(temp_dir)
+
+
+def test_alembic_detects_new_table_with_annotations(temp_alembic_env):
+    temp_dir, alembic_ini = temp_alembic_env
+    metadata = MetaData()
+    engine = create_engine("sqlite:///:memory:")
+
+    class Users(Table, table_name='users', metadata=metadata):
+        id: int
+        name: str
+        email: str
+        age: int
+
+    cfg = Config(str(alembic_ini))
+    cfg.attributes['target_metadata'] = metadata
+    cfg.attributes['connection'] = engine
+
+    with engine.begin() as connection:
+        mc = MigrationContext.configure(connection)
+        diff = compare_metadata(mc, metadata)
+
+    assert len(diff) > 0
+
+    add_table_ops = [op for op in diff if op[0] == 'add_table']
+    assert len(add_table_ops) == 1
+
+    table = add_table_ops[0][1]
+    assert table.name == 'users'
+    assert 'id' in [c.name for c in table.columns]
+    assert 'name' in [c.name for c in table.columns]
+    assert 'email' in [c.name for c in table.columns]
+    assert 'age' in [c.name for c in table.columns]
+
+
+def test_alembic_detects_new_table_with_sa_columns(temp_alembic_env):
+    temp_dir, alembic_ini = temp_alembic_env
+    metadata = MetaData()
+    engine = create_engine("sqlite:///:memory:")
+
+    class Posts(Table, table_name='posts', metadata=metadata):
+        id = Column(String, primary_key=True)
+        title = Column(String(255), nullable=False)
+        content = Column(String)
+        published = Column(Boolean, server_default='false')
+
+    cfg = Config(str(alembic_ini))
+    cfg.attributes['target_metadata'] = metadata
+    cfg.attributes['connection'] = engine
+
+    with engine.begin() as connection:
+        mc = MigrationContext.configure(connection)
+        diff = compare_metadata(mc, metadata)
+
+    add_table_ops = [op for op in diff if op[0] == 'add_table']
+    assert len(add_table_ops) == 1
+
+    table = add_table_ops[0][1]
+    assert table.name == 'posts'
+
+    id_col = next(c for c in table.columns if c.name == 'id')
+    assert id_col.primary_key
+
+    title_col = next(c for c in table.columns if c.name == 'title')
+    assert not title_col.nullable
+
+
+def test_alembic_detects_mixed_table_definition(temp_alembic_env):
+    temp_dir, alembic_ini = temp_alembic_env
+    metadata = MetaData()
+    engine = create_engine("sqlite:///:memory:")
+
+    class Users(Table, table_name='users', metadata=metadata):
+        id = Column(String, primary_key=True)
+
+    class Comments(Table, table_name='comments', metadata=metadata):
+        id = Column(String, primary_key=True)
+        post_id: str
+        user_id = Column(String, ForeignKey('users.id'))
+        content: str
+        upvotes: int
+        created_at = Column(TIMESTAMP, nullable=False)
+
+    cfg = Config(str(alembic_ini))
+    cfg.attributes['target_metadata'] = metadata
+    cfg.attributes['connection'] = engine
+
+    with engine.begin() as connection:
+        mc = MigrationContext.configure(connection)
+        diff = compare_metadata(mc, metadata)
+
+    add_table_ops = [op for op in diff if op[0] == 'add_table']
+    assert len(add_table_ops) == 2
+
+    table = next(op[1] for op in add_table_ops if op[1].name == 'comments')
+    assert table.name == 'comments'
+
+    column_names = [c.name for c in table.columns]
+    assert 'id' in column_names
+    assert 'post_id' in column_names
+    assert 'user_id' in column_names
+    assert 'content' in column_names
+    assert 'upvotes' in column_names
+    assert 'created_at' in column_names
+
+    user_id_col = next(c for c in table.columns if c.name == 'user_id')
+    assert len(list(user_id_col.foreign_keys)) == 1
+
+
+def test_alembic_detects_column_additions(temp_alembic_env):
+    temp_dir, alembic_ini = temp_alembic_env
+    metadata = MetaData()
+    engine = create_engine("sqlite:///:memory:")
+
+    with engine.begin() as connection:
+        connection.execute(sa_text("CREATE TABLE users (id INTEGER PRIMARY KEY, name TEXT)"))
+
+    class Users(Table, table_name='users', metadata=metadata):
+        id: int
+        name: str
+        email: str
+        age: int
+
+    cfg = Config(str(alembic_ini))
+    cfg.attributes['target_metadata'] = metadata
+    cfg.attributes['connection'] = engine
+
+    with engine.begin() as connection:
+        mc = MigrationContext.configure(connection)
+        diff = compare_metadata(mc, metadata)
+
+    add_column_ops = [op for op in diff if op[0] == 'add_column']
+    assert len(add_column_ops) == 2
+
+    added_column_names = [op[3].name for op in add_column_ops]
+    assert 'email' in added_column_names
+    assert 'age' in added_column_names
+
+
+def test_alembic_detects_column_removals(temp_alembic_env):
+    temp_dir, alembic_ini = temp_alembic_env
+    metadata = MetaData()
+    engine = create_engine("sqlite:///:memory:")
+
+    with engine.begin() as connection:
+        connection.execute(sa_text("CREATE TABLE users (id INTEGER PRIMARY KEY, name TEXT, old_field TEXT, deprecated TEXT)"))
+
+    class Users(Table, table_name='users', metadata=metadata):
+        id: int
+        name: str
+
+    cfg = Config(str(alembic_ini))
+    cfg.attributes['target_metadata'] = metadata
+    cfg.attributes['connection'] = engine
+
+    with engine.begin() as connection:
+        mc = MigrationContext.configure(connection)
+        diff = compare_metadata(mc, metadata)
+
+    remove_column_ops = [op for op in diff if op[0] == 'remove_column']
+    assert len(remove_column_ops) == 2
+
+    removed_column_names = [op[3].name for op in remove_column_ops]
+    assert 'old_field' in removed_column_names
+    assert 'deprecated' in removed_column_names
+
+
+def test_alembic_no_spurious_changes_for_identical_schema(temp_alembic_env):
+    temp_dir, alembic_ini = temp_alembic_env
+    metadata = MetaData()
+    engine = create_engine("sqlite:///:memory:")
+
+    class Users(Table, table_name='users', metadata=metadata):
+        id = Column(Integer, primary_key=True)
+        name = Column(String)
+        email = Column(String)
+
+    metadata.create_all(engine)
+
+    cfg = Config(str(alembic_ini))
+    cfg.attributes['target_metadata'] = metadata
+    cfg.attributes['connection'] = engine
+
+    with engine.begin() as connection:
+        mc = MigrationContext.configure(connection)
+        diff = compare_metadata(mc, metadata)
+
+    assert len(diff) == 0
+
+
+def test_alembic_handles_foreign_keys_correctly(temp_alembic_env):
+    temp_dir, alembic_ini = temp_alembic_env
+    metadata = MetaData()
+    engine = create_engine("sqlite:///:memory:")
+
+    class Users(Table, table_name='users', metadata=metadata):
+        id = Column(String, primary_key=True)
+
+    class Posts(Table, table_name='posts', metadata=metadata):
+        id = Column(String, primary_key=True)
+        user_id = Column(String, ForeignKey('users.id', ondelete='CASCADE'))
+        title: str
+
+    cfg = Config(str(alembic_ini))
+    cfg.attributes['target_metadata'] = metadata
+    cfg.attributes['connection'] = engine
+
+    with engine.begin() as connection:
+        mc = MigrationContext.configure(connection)
+        diff = compare_metadata(mc, metadata)
+
+    add_table_ops = [op for op in diff if op[0] == 'add_table']
+    assert len(add_table_ops) == 2
+
+    posts_table = next(op[1] for op in add_table_ops if op[1].name == 'posts')
+    user_id_col = next(c for c in posts_table.columns if c.name == 'user_id')
+
+    fks = list(user_id_col.foreign_keys)
+    assert len(fks) == 1
+    assert fks[0].column.table.name == 'users'
+
+
+def test_alembic_with_schema_parameter(temp_alembic_env):
+    temp_dir, alembic_ini = temp_alembic_env
+    metadata = MetaData()
+    engine = create_engine("sqlite:///:memory:")
+
+    class Users(Table, table_name='users', metadata=metadata, schema='public'):
+        id: int
+        name: str
+
+    cfg = Config(str(alembic_ini))
+    cfg.attributes['target_metadata'] = metadata
+    cfg.attributes['connection'] = engine
+
+    with engine.begin() as connection:
+        mc = MigrationContext.configure(connection)
+        diff = compare_metadata(mc, metadata)
+
+    add_table_ops = [op for op in diff if op[0] == 'add_table']
+    assert len(add_table_ops) == 1
+
+    table = add_table_ops[0][1]
+    assert table.schema == 'public'
+
+
+from sqlalchemy import text as sa_text

{t_sql-2.0.0 → t_sql-2.1.2}/tests/test_helper_functions.py

@@ -47,15 +47,9 @@ def test_as_set():
 
 def test_insert():
     """Test the insert helper function"""
-    values = {
-        'name': 'Alice',
-        'age': 25,
-        'active': True
-    }
-    
-    query = tsql.insert('users', values)
+    query = tsql.insert('users', name='Alice', age=25, active=True)
     result = tsql.render(query)
-    
+
     assert "INSERT INTO users" in result[0]
     assert "name" in result[0] and "age" in result[0] and "active" in result[0]
     assert "VALUES" in result[0]

{t_sql-2.0.0 → t_sql-2.1.2}/tests/test_injection_edge_cases.py

@@ -158,4 +158,156 @@ def test_unsafe_parameter_injection():
 
     # Test ESCAPED style with :unsafe (should behave the same)
     result_escaped = tsql.render(t"SELECT * FROM users WHERE debug = {malicious_value:unsafe}", style=tsql.styles.ESCAPED)
-    assert "DROP TABLE users" in result_escaped[0]  # Should be directly embedded
+    assert "DROP TABLE users" in result_escaped[0]  # Should be directly embedded
+
+
+def test_dictionary_key_injection_as_values():
+    """Test that malicious dictionary keys in :as_values are rejected"""
+    # Classic SQL injection in dictionary key
+    malicious_dict = {
+        "name); DROP TABLE users; --": "value"
+    }
+
+    with pytest.raises(ValueError, match="Invalid column name"):
+        tsql.render(t"INSERT INTO users {malicious_dict:as_values}")
+
+    # Semicolon in key
+    malicious_dict2 = {
+        "name; DELETE FROM users": "value"
+    }
+
+    with pytest.raises(ValueError, match="Invalid column name"):
+        tsql.render(t"INSERT INTO users {malicious_dict2:as_values}")
+
+    # Quote in key
+    malicious_dict3 = {
+        "name' OR '1'='1": "value"
+    }
+
+    with pytest.raises(ValueError, match="Invalid column name"):
+        tsql.render(t"INSERT INTO users {malicious_dict3:as_values}")
+
+    # Comment in key
+    malicious_dict4 = {
+        "name--": "value"
+    }
+
+    with pytest.raises(ValueError, match="Invalid column name"):
+        tsql.render(t"INSERT INTO users {malicious_dict4:as_values}")
+
+
+def test_dictionary_key_injection_as_set():
+    """Test that malicious dictionary keys in :as_set are rejected"""
+    # Classic injection attempt in UPDATE
+    malicious_dict = {
+        "email = 'hacker@evil.com' WHERE 1=1; --": "value"
+    }
+
+    with pytest.raises(ValueError, match="Invalid column name"):
+        tsql.render(t"UPDATE users SET {malicious_dict:as_set} WHERE id = 1")
+
+    # Another variant
+    malicious_dict2 = {
+        "role = 'admin'--": "user"
+    }
+
+    with pytest.raises(ValueError, match="Invalid column name"):
+        tsql.render(t"UPDATE users SET {malicious_dict2:as_set} WHERE id = 1")
+
+
+def test_empty_dictionary_as_values():
+    """Test that empty dictionaries are rejected in :as_values"""
+    empty_dict = {}
+
+    with pytest.raises(ValueError, match="at least one column"):
+        tsql.render(t"INSERT INTO users {empty_dict:as_values}")
+
+
+def test_empty_dictionary_as_set():
+    """Test that empty dictionaries are rejected in :as_set"""
+    empty_dict = {}
+
+    with pytest.raises(ValueError, match="at least one column"):
+        tsql.render(t"UPDATE users SET {empty_dict:as_set} WHERE id = 1")
+
+
+def test_non_string_dictionary_keys():
+    """Test that non-string dictionary keys are rejected"""
+    # Integer key
+    int_key_dict = {
+        123: "value"
+    }
+
+    with pytest.raises(ValueError, match="Invalid column name"):
+        tsql.render(t"INSERT INTO users {int_key_dict:as_values}")
+
+    # Tuple key
+    tuple_key_dict = {
+        ("name", "value"): "test"
+    }
+
+    with pytest.raises(ValueError, match="Invalid column name"):
+        tsql.render(t"INSERT INTO users {tuple_key_dict:as_values}")
+
+
+def test_valid_dictionary_keys_still_work():
+    """Test that valid identifiers still work in dictionaries"""
+    # Simple identifier
+    valid_dict = {
+        "name": "Alice",
+        "age": 30
+    }
+
+    result = tsql.render(t"INSERT INTO users {valid_dict:as_values}")
+    assert "(name, age) VALUES (?, ?)" in result[0]
+    assert result[1] == ["Alice", 30]
+
+    # Valid identifiers with underscores
+    valid_dict2 = {
+        "first_name": "Bob",
+        "last_name": "Smith"
+    }
+
+    result2 = tsql.render(t"UPDATE users SET {valid_dict2:as_set} WHERE id = 1")
+    assert "first_name = ?" in result2[0]
+    assert "last_name = ?" in result2[0]
+    assert result2[1] == ["Bob", "Smith"]
+
+
+def test_literal_too_many_parts():
+    """Test that literals with more than 3 parts are rejected"""
+    # 4 parts should be rejected
+    four_part_literal = "a.b.c.d"
+    with pytest.raises(ValueError, match="too many parts"):
+        tsql.render(t"SELECT * FROM {four_part_literal:literal}")
+
+    # 5 parts should be rejected
+    five_part_literal = "a.b.c.d.e"
+    with pytest.raises(ValueError, match="too many parts"):
+        tsql.render(t"SELECT * FROM {five_part_literal:literal}")
+
+    # Many parts should be rejected
+    many_parts_literal = ".".join(["a"] * 10)
+    with pytest.raises(ValueError, match="too many parts"):
+        tsql.render(t"SELECT * FROM {many_parts_literal:literal}")
+
+
+def test_literal_valid_parts():
+    """Test that literals with 1-3 parts are accepted"""
+    # 1 part (simple table name)
+    one_part = "users"
+    result = tsql.render(t"SELECT * FROM {one_part:literal}")
+    assert result[0] == "SELECT * FROM users"
+    assert result[1] == []
+
+    # 2 parts (schema.table)
+    two_parts = "public.users"
+    result = tsql.render(t"SELECT * FROM {two_parts:literal}")
+    assert result[0] == "SELECT * FROM public.users"
+    assert result[1] == []
+
+    # 3 parts (database.schema.table or schema.table.column)
+    three_parts = "mydb.public.users"
+    result = tsql.render(t"SELECT * FROM {three_parts:literal}")
+    assert result[0] == "SELECT * FROM mydb.public.users"
+    assert result[1] == []

{t_sql-2.0.0 → t_sql-2.1.2}/tests/test_mysql_integration.py

@@ -85,16 +85,14 @@ async def test_insert_ignore(conn):
         email: str
 
     # Insert first row
-    values1 = {'name': 'Alice', 'email': 'alice@example.com'}
-    query1 = TestUsers.insert(values1)
+    query1 = TestUsers.insert(name='Alice', email='alice@example.com')
     sql1, params1 = query1.render(style=tsql.styles.FORMAT)
 
     await cursor.execute(sql1, params1)
     await connection.commit()
 
     # Try to insert duplicate email with INSERT IGNORE
-    values2 = {'name': 'Bob', 'email': 'alice@example.com'}
-    query2 = TestUsers.insert(values2).ignore()
+    query2 = TestUsers.insert(name='Bob', email='alice@example.com').ignore()
     sql2, params2 = query2.render(style=tsql.styles.FORMAT)
 
     assert 'INSERT IGNORE' in sql2
@@ -126,16 +124,14 @@ async def test_on_duplicate_key_update(conn):
         age: int
 
     # Insert first row
-    values1 = {'name': 'Alice', 'email': 'alice@example.com', 'age': 30}
-    query1 = TestUsers.insert(values1)
+    query1 = TestUsers.insert(name='Alice', email='alice@example.com', age=30)
     sql1, params1 = query1.render(style=tsql.styles.FORMAT)
 
     await cursor.execute(sql1, params1)
     await connection.commit()
 
     # Insert with duplicate email, but update on conflict
-    values2 = {'name': 'Alice Updated', 'email': 'alice@example.com', 'age': 31}
-    query2 = TestUsers.insert(values2).on_duplicate_key_update()
+    query2 = TestUsers.insert(name='Alice Updated', email='alice@example.com', age=31).on_duplicate_key_update()
     sql2, params2 = query2.render(style=tsql.styles.FORMAT)
 
     assert 'ON DUPLICATE KEY UPDATE' in sql2
@@ -250,8 +246,7 @@ async def test_helper_functions(conn):
     connection, cursor = conn
 
     # Test insert
-    values = {'name': 'Bob', 'email': 'bob@example.com', 'age': 25}
-    query = tsql.insert('test_users', values)
+    query = tsql.insert('test_users', name='Bob', email='bob@example.com', age=25)
     sql, params = query.render(style=tsql.styles.FORMAT)
 
     await cursor.execute(sql, params)