t-sql 3.0.0__tar.gz → 3.2.0__tar.gz

{t_sql-3.0.0 → t_sql-3.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: t-sql
-Version: 3.0.0
+Version: 3.2.0
 Summary: Safe SQL. SQL queries for python t-strings (PEP 750)
 Project-URL: Homepage, https://github.com/nhumrich/t-sql
 License-File: LICENSE
@@ -159,8 +159,7 @@ sql, params = query.render()
 Quick INSERT queries:
 
 ```python
-values = {'id': 'abc123', 'name': 'bob', 'email': 'bob@example.com'}
-query = tsql.insert('users', values)
+query = tsql.insert('users', id='abc123', name='bob', email='bob@example.com')
 sql, params = query.render()
 # ('INSERT INTO users (id, name, email) VALUES (?, ?, ?)', ['abc123', 'bob', 'bob@example.com'])
 ```
@@ -171,14 +170,9 @@ Quick UPDATE queries:
 
 ```python
 # Update by ID
-query = tsql.update('users', {'email': 'new@example.com'}, id_value='abc123')
+query = tsql.update('users', 'abc123', email='new@example.com')
 sql, params = query.render()
 # ('UPDATE users SET email = ? WHERE id = ?', ['new@example.com', 'abc123'])
-
-# Update with custom WHERE
-query = tsql.update('users', {'email': 'new@example.com'}, where={'age': 25})
-sql, params = query.render()
-# ('UPDATE users SET email = ? WHERE age = ?', ['new@example.com', 25])
 ```
 
 #### delete
@@ -271,8 +265,9 @@ query = Users.select().where(Users.id.in_([1, 2, 3]))
 query = Users.select().where(Users.username.like('%john%'))
 
 # ORDER BY
-query = Posts.select().order_by(Posts.id)
-query = Posts.select().order_by((Posts.id, 'DESC'))
+query = Posts.select().order_by(Posts.id)  # defaults to ASC
+query = Posts.select().order_by(Posts.id.desc())
+query = Posts.select().order_by(Posts.created_at.asc(), Posts.id.desc())
 
 # LIMIT and OFFSET
 query = Posts.select().limit(10).offset(20)
@@ -291,47 +286,46 @@ The query builder supports INSERT, UPDATE, and DELETE with database-agnostic con
 
 ```python
 # Basic insert
-values = {'id': 'abc123', 'username': 'john', 'email': 'john@example.com'}
-query = Users.insert(values)
+query = Users.insert(id='abc123', username='john', email='john@example.com')
 sql, params = query.render()
 # ('INSERT INTO users (id, username, email) VALUES (?, ?, ?)', ['abc123', 'john', 'john@example.com'])
 
 # INSERT with RETURNING (Postgres/SQLite)
-query = Users.insert(values).returning()
+query = Users.insert(id='abc123', username='john', email='john@example.com').returning()
 sql, params = query.render()
 # ('INSERT INTO users (id, username, email) VALUES (?, ?, ?) RETURNING *', [...])
 
 # INSERT IGNORE (MySQL)
-query = Users.insert(values).ignore()
+query = Users.insert(id='abc123', username='john', email='john@example.com').ignore()
 sql, params = query.render()
 # ('INSERT IGNORE INTO users (id, username, email) VALUES (?, ?, ?)', [...])
 
 # ON CONFLICT DO NOTHING (Postgres/SQLite)
-query = Users.insert(values).on_conflict_do_nothing()
+query = Users.insert(id='abc123', username='john', email='john@example.com').on_conflict_do_nothing()
 # ('INSERT INTO users (...) VALUES (...) ON CONFLICT DO NOTHING', [...])
 
 # ON CONFLICT DO NOTHING with specific conflict target (Postgres/SQLite)
-query = Users.insert(values).on_conflict_do_nothing(conflict_on='email')
+query = Users.insert(id='abc123', username='john', email='john@example.com').on_conflict_do_nothing(conflict_on='email')
 # ('INSERT INTO users (...) VALUES (...) ON CONFLICT (email) DO NOTHING', [...])
 
 # ON CONFLICT DO UPDATE (Postgres/SQLite upsert)
-query = Users.insert(values).on_conflict_update(conflict_on='id')
+query = Users.insert(id='abc123', username='john', email='john@example.com').on_conflict_update(conflict_on='id')
 # ('INSERT INTO users (...) VALUES (...)
 #   ON CONFLICT (id) DO UPDATE SET username = EXCLUDED.username, email = EXCLUDED.email', [...])
 
 # ON CONFLICT with custom update
-query = Users.insert(values).on_conflict_update(
+query = Users.insert(id='abc123', username='john', email='john@example.com').on_conflict_update(
     conflict_on='id',
     update={'username': 'updated_name'}
 )
 
 # ON DUPLICATE KEY UPDATE (MySQL)
-query = Users.insert(values).on_duplicate_key_update()
+query = Users.insert(id='abc123', username='john', email='john@example.com').on_duplicate_key_update()
 # ('INSERT INTO users (...) VALUES (...)
 #   ON DUPLICATE KEY UPDATE id = VALUES(id), username = VALUES(username), ...', [...])
 
 # Chain multiple modifiers
-query = (Users.insert(values)
+query = (Users.insert(id='abc123', username='john', email='john@example.com')
          .on_conflict_update(conflict_on='id')
          .returning('id', 'username'))
 ```
@@ -339,23 +333,27 @@ query = (Users.insert(values)
 ### UPDATE
 
 ```python
-# Basic update (no WHERE = updates all rows!)
-query = Users.update({'email': 'newemail@example.com'})
-sql, params = query.render()
-# ('UPDATE users SET email = ?', ['newemail@example.com'])
+# UPDATE requires WHERE clause or explicit .all_rows() for safety
+query = Users.update(email='newemail@example.com')
+# ❌ Raises UnsafeQueryError: UPDATE without WHERE requires .all_rows()
 
 # UPDATE with WHERE
-query = Users.update({'email': 'newemail@example.com'}).where(Users.id == 'abc123')
+query = Users.update(email='newemail@example.com').where(Users.id == 'abc123')
 sql, params = query.render()
 # ('UPDATE users SET email = ? WHERE users.id = ?', ['newemail@example.com', 'abc123'])
 
 # Multiple WHERE conditions
-query = (Users.update({'email': 'newemail@example.com'})
+query = (Users.update(email='newemail@example.com')
          .where(Users.id == 'abc123')
          .where(Users.age > 18))
 
+# Explicitly update all rows (use with caution!)
+query = Users.update(status='inactive').all_rows()
+sql, params = query.render()
+# ('UPDATE users SET status = ?', ['inactive'])
+
 # With RETURNING (Postgres/SQLite)
-query = (Users.update({'email': 'new@example.com'})
+query = (Users.update(email='new@example.com')
          .where(Users.id == 'abc123')
          .returning())
 # ('UPDATE users SET email = ? WHERE users.id = ? RETURNING *', [...])
@@ -364,10 +362,9 @@ query = (Users.update({'email': 'new@example.com'})
 ### DELETE
 
 ```python
-# Basic delete (no WHERE = deletes all rows!)
+# DELETE requires WHERE clause or explicit .all_rows() for safety
 query = Users.delete()
-sql, params = query.render()
-# ('DELETE FROM users', [])
+# ❌ Raises UnsafeQueryError: DELETE without WHERE requires .all_rows()
 
 # DELETE with WHERE
 query = Users.delete().where(Users.id == 'abc123')
@@ -377,6 +374,11 @@ sql, params = query.render()
 # Multiple conditions
 query = Users.delete().where(Users.age < 18).where(Users.active == False)
 
+# Explicitly delete all rows (use with extreme caution!)
+query = Users.delete().all_rows()
+sql, params = query.render()
+# ('DELETE FROM users', [])
+
 # With RETURNING (Postgres/SQLite)
 query = Users.delete().where(Users.id == 'abc123').returning()
 # ('DELETE FROM users WHERE users.id = ? RETURNING *', ['abc123'])
@@ -632,6 +634,27 @@ sql, _ = tsql.render(t"SELECT * FROM users WHERE name = {malicious}", style=tsql
 
 **Important:** While effective, parameterization is always preferred when available. Use `ESCAPED` only when necessary.
 
+### 4. Query Builder Safety: UPDATE/DELETE Protection
+
+The query builder prevents accidental mass UPDATE/DELETE operations by requiring an explicit WHERE clause or `.all_rows()` call:
+
+```python
+from tsql import UnsafeQueryError
+
+# This raises UnsafeQueryError at render time
+Users.update(status='inactive').render()  # ❌ Error!
+Users.delete().render()  # ❌ Error!
+
+# Must add WHERE clause
+Users.update(status='inactive').where(Users.id == user_id).render()  # ✅
+
+# Or explicitly confirm mass operation
+Users.update(status='inactive').all_rows().render()  # ✅
+Users.delete().all_rows().render()  # ✅
+```
+
+This protection catches the most common and dangerous SQL mistake: forgetting the WHERE clause. 
+
 ## Danger Zones: Where You Can Still Get Hurt
 
 ### The :unsafe Format Spec

{t_sql-3.0.0 → t_sql-3.2.0}/README.md

@@ -149,8 +149,7 @@ sql, params = query.render()
 Quick INSERT queries:
 
 ```python
-values = {'id': 'abc123', 'name': 'bob', 'email': 'bob@example.com'}
-query = tsql.insert('users', values)
+query = tsql.insert('users', id='abc123', name='bob', email='bob@example.com')
 sql, params = query.render()
 # ('INSERT INTO users (id, name, email) VALUES (?, ?, ?)', ['abc123', 'bob', 'bob@example.com'])
 ```
@@ -161,14 +160,9 @@ Quick UPDATE queries:
 
 ```python
 # Update by ID
-query = tsql.update('users', {'email': 'new@example.com'}, id_value='abc123')
+query = tsql.update('users', 'abc123', email='new@example.com')
 sql, params = query.render()
 # ('UPDATE users SET email = ? WHERE id = ?', ['new@example.com', 'abc123'])
-
-# Update with custom WHERE
-query = tsql.update('users', {'email': 'new@example.com'}, where={'age': 25})
-sql, params = query.render()
-# ('UPDATE users SET email = ? WHERE age = ?', ['new@example.com', 25])
 ```
 
 #### delete
@@ -261,8 +255,9 @@ query = Users.select().where(Users.id.in_([1, 2, 3]))
 query = Users.select().where(Users.username.like('%john%'))
 
 # ORDER BY
-query = Posts.select().order_by(Posts.id)
-query = Posts.select().order_by((Posts.id, 'DESC'))
+query = Posts.select().order_by(Posts.id)  # defaults to ASC
+query = Posts.select().order_by(Posts.id.desc())
+query = Posts.select().order_by(Posts.created_at.asc(), Posts.id.desc())
 
 # LIMIT and OFFSET
 query = Posts.select().limit(10).offset(20)
@@ -281,47 +276,46 @@ The query builder supports INSERT, UPDATE, and DELETE with database-agnostic con
 
 ```python
 # Basic insert
-values = {'id': 'abc123', 'username': 'john', 'email': 'john@example.com'}
-query = Users.insert(values)
+query = Users.insert(id='abc123', username='john', email='john@example.com')
 sql, params = query.render()
 # ('INSERT INTO users (id, username, email) VALUES (?, ?, ?)', ['abc123', 'john', 'john@example.com'])
 
 # INSERT with RETURNING (Postgres/SQLite)
-query = Users.insert(values).returning()
+query = Users.insert(id='abc123', username='john', email='john@example.com').returning()
 sql, params = query.render()
 # ('INSERT INTO users (id, username, email) VALUES (?, ?, ?) RETURNING *', [...])
 
 # INSERT IGNORE (MySQL)
-query = Users.insert(values).ignore()
+query = Users.insert(id='abc123', username='john', email='john@example.com').ignore()
 sql, params = query.render()
 # ('INSERT IGNORE INTO users (id, username, email) VALUES (?, ?, ?)', [...])
 
 # ON CONFLICT DO NOTHING (Postgres/SQLite)
-query = Users.insert(values).on_conflict_do_nothing()
+query = Users.insert(id='abc123', username='john', email='john@example.com').on_conflict_do_nothing()
 # ('INSERT INTO users (...) VALUES (...) ON CONFLICT DO NOTHING', [...])
 
 # ON CONFLICT DO NOTHING with specific conflict target (Postgres/SQLite)
-query = Users.insert(values).on_conflict_do_nothing(conflict_on='email')
+query = Users.insert(id='abc123', username='john', email='john@example.com').on_conflict_do_nothing(conflict_on='email')
 # ('INSERT INTO users (...) VALUES (...) ON CONFLICT (email) DO NOTHING', [...])
 
 # ON CONFLICT DO UPDATE (Postgres/SQLite upsert)
-query = Users.insert(values).on_conflict_update(conflict_on='id')
+query = Users.insert(id='abc123', username='john', email='john@example.com').on_conflict_update(conflict_on='id')
 # ('INSERT INTO users (...) VALUES (...)
 #   ON CONFLICT (id) DO UPDATE SET username = EXCLUDED.username, email = EXCLUDED.email', [...])
 
 # ON CONFLICT with custom update
-query = Users.insert(values).on_conflict_update(
+query = Users.insert(id='abc123', username='john', email='john@example.com').on_conflict_update(
     conflict_on='id',
     update={'username': 'updated_name'}
 )
 
 # ON DUPLICATE KEY UPDATE (MySQL)
-query = Users.insert(values).on_duplicate_key_update()
+query = Users.insert(id='abc123', username='john', email='john@example.com').on_duplicate_key_update()
 # ('INSERT INTO users (...) VALUES (...)
 #   ON DUPLICATE KEY UPDATE id = VALUES(id), username = VALUES(username), ...', [...])
 
 # Chain multiple modifiers
-query = (Users.insert(values)
+query = (Users.insert(id='abc123', username='john', email='john@example.com')
          .on_conflict_update(conflict_on='id')
          .returning('id', 'username'))
 ```
@@ -329,23 +323,27 @@ query = (Users.insert(values)
 ### UPDATE
 
 ```python
-# Basic update (no WHERE = updates all rows!)
-query = Users.update({'email': 'newemail@example.com'})
-sql, params = query.render()
-# ('UPDATE users SET email = ?', ['newemail@example.com'])
+# UPDATE requires WHERE clause or explicit .all_rows() for safety
+query = Users.update(email='newemail@example.com')
+# ❌ Raises UnsafeQueryError: UPDATE without WHERE requires .all_rows()
 
 # UPDATE with WHERE
-query = Users.update({'email': 'newemail@example.com'}).where(Users.id == 'abc123')
+query = Users.update(email='newemail@example.com').where(Users.id == 'abc123')
 sql, params = query.render()
 # ('UPDATE users SET email = ? WHERE users.id = ?', ['newemail@example.com', 'abc123'])
 
 # Multiple WHERE conditions
-query = (Users.update({'email': 'newemail@example.com'})
+query = (Users.update(email='newemail@example.com')
          .where(Users.id == 'abc123')
          .where(Users.age > 18))
 
+# Explicitly update all rows (use with caution!)
+query = Users.update(status='inactive').all_rows()
+sql, params = query.render()
+# ('UPDATE users SET status = ?', ['inactive'])
+
 # With RETURNING (Postgres/SQLite)
-query = (Users.update({'email': 'new@example.com'})
+query = (Users.update(email='new@example.com')
          .where(Users.id == 'abc123')
          .returning())
 # ('UPDATE users SET email = ? WHERE users.id = ? RETURNING *', [...])
@@ -354,10 +352,9 @@ query = (Users.update({'email': 'new@example.com'})
 ### DELETE
 
 ```python
-# Basic delete (no WHERE = deletes all rows!)
+# DELETE requires WHERE clause or explicit .all_rows() for safety
 query = Users.delete()
-sql, params = query.render()
-# ('DELETE FROM users', [])
+# ❌ Raises UnsafeQueryError: DELETE without WHERE requires .all_rows()
 
 # DELETE with WHERE
 query = Users.delete().where(Users.id == 'abc123')
@@ -367,6 +364,11 @@ sql, params = query.render()
 # Multiple conditions
 query = Users.delete().where(Users.age < 18).where(Users.active == False)
 
+# Explicitly delete all rows (use with extreme caution!)
+query = Users.delete().all_rows()
+sql, params = query.render()
+# ('DELETE FROM users', [])
+
 # With RETURNING (Postgres/SQLite)
 query = Users.delete().where(Users.id == 'abc123').returning()
 # ('DELETE FROM users WHERE users.id = ? RETURNING *', ['abc123'])
@@ -622,6 +624,27 @@ sql, _ = tsql.render(t"SELECT * FROM users WHERE name = {malicious}", style=tsql
 
 **Important:** While effective, parameterization is always preferred when available. Use `ESCAPED` only when necessary.
 
+### 4. Query Builder Safety: UPDATE/DELETE Protection
+
+The query builder prevents accidental mass UPDATE/DELETE operations by requiring an explicit WHERE clause or `.all_rows()` call:
+
+```python
+from tsql import UnsafeQueryError
+
+# This raises UnsafeQueryError at render time
+Users.update(status='inactive').render()  # ❌ Error!
+Users.delete().render()  # ❌ Error!
+
+# Must add WHERE clause
+Users.update(status='inactive').where(Users.id == user_id).render()  # ✅
+
+# Or explicitly confirm mass operation
+Users.update(status='inactive').all_rows().render()  # ✅
+Users.delete().all_rows().render()  # ✅
+```
+
+This protection catches the most common and dangerous SQL mistake: forgetting the WHERE clause. 
+
 ## Danger Zones: Where You Can Still Get Hurt
 
 ### The :unsafe Format Spec

{t_sql-3.0.0 → t_sql-3.2.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "t-sql"
-version = "3.0.0"
+version = "3.2.0"
 description = "Safe SQL. SQL queries for python t-strings (PEP 750)"
 readme = "README.md"
 requires-python = ">=3.14"

{t_sql-3.0.0 → t_sql-3.2.0}/tests/test_query_builder.py

@@ -213,7 +213,7 @@ def test_order_by():
 
 def test_order_by_desc():
     """Test ORDER BY with DESC"""
-    query = Users.select().order_by((Users.id, 'DESC'))
+    query = Users.select().order_by(Users.id.desc())
     sql, params = query.render()
 
     assert 'ORDER BY users.id DESC' in sql
@@ -221,7 +221,39 @@ def test_order_by_desc():
 
 def test_order_by_multiple():
     """Test ORDER BY with multiple columns"""
-    query = Users.select().order_by(Users.username, (Users.id, 'DESC'))
+    query = Users.select().order_by(Users.username, Users.id.desc())
+    sql, params = query.render()
+
+    assert 'ORDER BY users.username ASC, users.id DESC' in sql
+
+
+def test_order_by_asc_method():
+    """Test ORDER BY with .asc() method"""
+    query = Users.select().order_by(Users.username.asc())
+    sql, params = query.render()
+
+    assert 'ORDER BY users.username ASC' in sql
+
+
+def test_order_by_desc_method():
+    """Test ORDER BY with .desc() method"""
+    query = Users.select().order_by(Users.id.desc())
+    sql, params = query.render()
+
+    assert 'ORDER BY users.id DESC' in sql
+
+
+def test_order_by_mixed_methods():
+    """Test ORDER BY with mixed .asc() and .desc() methods"""
+    query = Users.select().order_by(Users.username.asc(), Users.id.desc())
+    sql, params = query.render()
+
+    assert 'ORDER BY users.username ASC, users.id DESC' in sql
+
+
+def test_order_by_mixed_syntax():
+    """Test ORDER BY with mixed method calls and bare columns"""
+    query = Users.select().order_by(Users.username, Users.id.desc())
     sql, params = query.render()
 
     assert 'ORDER BY users.username ASC, users.id DESC' in sql
@@ -242,7 +274,7 @@ def test_complex_query():
              .join(Users, Posts.user_id == Users.id)
              .where(Posts.id > 100)
              .where(Users.id >= 5)
-             .order_by((Posts.id, 'DESC'))
+             .order_by(Posts.id.desc())
              .limit(20))
     sql, params = query.render()
 
@@ -480,7 +512,7 @@ def test_complex_aggregation_query():
              .where(Posts.id > 100)
              .group_by(Posts.user_id)
              .having(Posts.id > 5)
-             .order_by((Posts.user_id, 'DESC'))
+             .order_by(Posts.user_id.desc())
              .limit(10)
              .offset(5))
     sql, params = query.render()
@@ -1140,7 +1172,7 @@ def test_returning_cols_validation_update():
     import pytest
 
     # Test with malicious returning column
-    query = Users.update(username='hacked')
+    query = Users.update(username='hacked').all_rows()
     builder = query.returning("id, (SELECT password FROM admin_users LIMIT 1) AS stolen")
 
     with pytest.raises(ValueError, match="Invalid RETURNING column name"):
@@ -1159,7 +1191,7 @@ def test_returning_cols_validation_delete():
     import pytest
 
     # Test with malicious returning column
-    query = Users.delete()
+    query = Users.delete().all_rows()
     builder = query.returning("* FROM users; DROP TABLE secrets; --")
 
     with pytest.raises(ValueError, match="Invalid RETURNING column name"):
@@ -1190,3 +1222,46 @@ def test_conflict_cols_list_validation():
     sql, params = builder2.render()
 
     assert 'ON CONFLICT (id, email)' in sql
+
+
+def test_update_without_where_raises_error():
+    """Test that UPDATE without WHERE clause raises UnsafeQueryError"""
+    import pytest
+    from tsql.query_builder import UnsafeQueryError
+
+    builder = Users.update(username='updated')
+
+    with pytest.raises(UnsafeQueryError, match="UPDATE without WHERE clause requires explicit .all_rows()"):
+        builder.render()
+
+
+def test_update_with_all_rows_works():
+    """Test that UPDATE with .all_rows() bypasses safety check"""
+    builder = Users.update(username='updated').all_rows()
+    sql, params = builder.render()
+
+    assert 'UPDATE users SET' in sql
+    assert 'username = ?' in sql
+    assert 'WHERE' not in sql
+    assert params == ['updated']
+
+
+def test_delete_without_where_raises_error():
+    """Test that DELETE without WHERE clause raises UnsafeQueryError"""
+    import pytest
+    from tsql.query_builder import UnsafeQueryError
+
+    builder = Users.delete()
+
+    with pytest.raises(UnsafeQueryError, match="DELETE without WHERE clause requires explicit .all_rows()"):
+        builder.render()
+
+
+def test_delete_with_all_rows_works():
+    """Test that DELETE with .all_rows() bypasses safety check"""
+    builder = Users.delete().all_rows()
+    sql, params = builder.render()
+
+    assert 'DELETE FROM users' in sql
+    assert 'WHERE' not in sql
+    assert params == []

{t_sql-3.0.0 → t_sql-3.2.0}/tests/test_sqlite_integration.py

@@ -331,7 +331,7 @@ async def test_query_builder_select(conn):
     assert rows[0][0] == 'Alice'
 
     # Test ORDER BY
-    query = TestUsers.select().order_by((TestUsers.age, 'DESC'))
+    query = TestUsers.select().order_by(TestUsers.age.desc())
     sql, params = query.render()
 
     cursor = await conn.execute(sql, params)

{t_sql-3.0.0 → t_sql-3.2.0}/tsql/__init__.py

@@ -360,6 +360,8 @@ def delete(table: str, id: str | int) -> TSQL:
     return TSQL(t"DELETE FROM {table:literal} WHERE id = {id}")
 
 
+from tsql.query_builder import UnsafeQueryError
+
 __all__ = [
     'TSQL',
     'TSQLQuery',
@@ -370,5 +372,6 @@ __all__ = [
     'update',
     'delete',
     'set_style',
+    'UnsafeQueryError',
 ]
 

{t_sql-3.0.0 → t_sql-3.2.0}/tsql/query_builder.py

@@ -5,6 +5,14 @@ from abc import ABC, abstractmethod
 
 from tsql import TSQL, t_join
 
+
+class UnsafeQueryError(Exception):
+    """Raised when attempting to render an UPDATE or DELETE query without a WHERE clause.
+
+    To perform mass updates or deletes, explicitly call .all_rows() to confirm intent.
+    """
+    pass
+
 # Optional SQLAlchemy support
 try:
     from sqlalchemy import MetaData, Table as SATable, Column as SAColumn
@@ -16,6 +24,17 @@ except ImportError:
     SAColumnType = None
 
 
+class OrderByClause:
+    """Represents a column with an ORDER BY direction (ASC/DESC)"""
+
+    def __init__(self, column: 'Column', direction: str):
+        self.column = column
+        self.direction = direction.upper()
+
+    def __repr__(self) -> str:
+        return f"OrderByClause({self.column!r}, {self.direction!r})"
+
+
 class Column:
     """Represents a bound column (table + column name) for building queries"""
 
@@ -140,6 +159,28 @@ class Column:
         """Create an IS NOT NULL condition"""
         return Condition(self, 'IS NOT', None)
 
+    def asc(self) -> OrderByClause:
+        """Create an ascending ORDER BY clause
+
+        Returns:
+            OrderByClause for use in order_by()
+
+        Example:
+            Users.select().order_by(Users.username.asc())
+        """
+        return OrderByClause(self, 'ASC')
+
+    def desc(self) -> OrderByClause:
+        """Create a descending ORDER BY clause
+
+        Returns:
+            OrderByClause for use in order_by()
+
+        Example:
+            Users.select().order_by(Users.created_at.desc())
+        """
+        return OrderByClause(self, 'DESC')
+
 
 class Table:
     """Base class for all table definitions. Provides query builder methods.
@@ -654,10 +695,27 @@ class UpdateBuilder(QueryBuilder):
 
         self._conditions: List[Union[Condition, Template]] = []
         self._returning_cols: Optional[List[str]] = None
+        self._requires_where: bool = True
 
     def where(self, condition: Union[Condition, Template]) -> 'UpdateBuilder':
         """Add a WHERE condition (multiple calls are ANDed together)"""
         self._conditions.append(condition)
+        self._requires_where = False
+        return self
+
+    def all_rows(self) -> 'UpdateBuilder':
+        """Explicitly confirm intent to update all rows without a WHERE clause.
+
+        By default, UPDATE queries without WHERE clauses will raise UnsafeQueryError
+        at render time. Call this method to bypass that safety check.
+
+        Returns:
+            self for method chaining
+
+        Example:
+            Users.update(status='inactive').all_rows()
+        """
+        self._requires_where = False
         return self
 
     def returning(self, *columns: str) -> 'UpdateBuilder':
@@ -703,6 +761,11 @@ class UpdateBuilder(QueryBuilder):
 
     def render(self, style=None):
         """Convenience method to render the query directly"""
+        if self._requires_where:
+            raise UnsafeQueryError(
+                "UPDATE without WHERE clause requires explicit .all_rows() call to confirm intent. "
+                "This prevents accidentally updating all rows in the table."
+            )
         return self.to_tsql().render(style)
 
     def __repr__(self) -> str:
@@ -723,10 +786,27 @@ class DeleteBuilder(QueryBuilder):
         self.base_table = base_table
         self._conditions: List[Union[Condition, Template]] = []
         self._returning_cols: Optional[List[str]] = None
+        self._requires_where: bool = True
 
     def where(self, condition: Union[Condition, Template]) -> 'DeleteBuilder':
         """Add a WHERE condition (multiple calls are ANDed together)"""
         self._conditions.append(condition)
+        self._requires_where = False
+        return self
+
+    def all_rows(self) -> 'DeleteBuilder':
+        """Explicitly confirm intent to delete all rows without a WHERE clause.
+
+        By default, DELETE queries without WHERE clauses will raise UnsafeQueryError
+        at render time. Call this method to bypass that safety check.
+
+        Returns:
+            self for method chaining
+
+        Example:
+            Users.delete().all_rows()
+        """
+        self._requires_where = False
         return self
 
     def returning(self, *columns: str) -> 'DeleteBuilder':
@@ -771,6 +851,11 @@ class DeleteBuilder(QueryBuilder):
 
     def render(self, style=None):
         """Convenience method to render the query directly"""
+        if self._requires_where:
+            raise UnsafeQueryError(
+                "DELETE without WHERE clause requires explicit .all_rows() call to confirm intent. "
+                "This prevents accidentally deleting all rows in the table."
+            )
         return self.to_tsql().render(style)
 
     def __repr__(self) -> str:
@@ -838,11 +923,22 @@ class SelectQueryBuilder(QueryBuilder):
         """Add a RIGHT JOIN clause"""
         return self.join(table, on, 'RIGHT')
 
-    def order_by(self, *columns: Union[Column, tuple[Column, str]]) -> 'SelectQueryBuilder':
-        """Add ORDER BY clause. Pass (column, 'DESC') for descending"""
+    def order_by(self, *columns: Union[Column, OrderByClause]) -> 'SelectQueryBuilder':
+        """Add ORDER BY clause
+
+        Args:
+            columns: Column objects or OrderByClause objects (from .asc()/.desc())
+
+        Examples:
+            # Using .asc() and .desc() methods
+            Users.select().order_by(Users.username.asc(), Users.id.desc())
+
+            # Bare column defaults to ASC
+            Users.select().order_by(Users.username)
+        """
         for col in columns:
-            if isinstance(col, tuple):
-                self._order_by_columns.append(col)
+            if isinstance(col, OrderByClause):
+                self._order_by_columns.append((col.column, col.direction))
             else:
                 self._order_by_columns.append((col, 'ASC'))
         return self