t-sql 3.1.0__tar.gz → 3.2.0__tar.gz

{t_sql-3.1.0 → t_sql-3.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: t-sql
-Version: 3.1.0
+Version: 3.2.0
 Summary: Safe SQL. SQL queries for python t-strings (PEP 750)
 Project-URL: Homepage, https://github.com/nhumrich/t-sql
 License-File: LICENSE
@@ -333,10 +333,9 @@ query = (Users.insert(id='abc123', username='john', email='john@example.com')
 ### UPDATE
 
 ```python
-# Basic update (no WHERE = updates all rows!)
+# UPDATE requires WHERE clause or explicit .all_rows() for safety
 query = Users.update(email='newemail@example.com')
-sql, params = query.render()
-# ('UPDATE users SET email = ?', ['newemail@example.com'])
+# ❌ Raises UnsafeQueryError: UPDATE without WHERE requires .all_rows()
 
 # UPDATE with WHERE
 query = Users.update(email='newemail@example.com').where(Users.id == 'abc123')
@@ -348,6 +347,11 @@ query = (Users.update(email='newemail@example.com')
          .where(Users.id == 'abc123')
          .where(Users.age > 18))
 
+# Explicitly update all rows (use with caution!)
+query = Users.update(status='inactive').all_rows()
+sql, params = query.render()
+# ('UPDATE users SET status = ?', ['inactive'])
+
 # With RETURNING (Postgres/SQLite)
 query = (Users.update(email='new@example.com')
          .where(Users.id == 'abc123')
@@ -358,10 +362,9 @@ query = (Users.update(email='new@example.com')
 ### DELETE
 
 ```python
-# Basic delete (no WHERE = deletes all rows!)
+# DELETE requires WHERE clause or explicit .all_rows() for safety
 query = Users.delete()
-sql, params = query.render()
-# ('DELETE FROM users', [])
+# ❌ Raises UnsafeQueryError: DELETE without WHERE requires .all_rows()
 
 # DELETE with WHERE
 query = Users.delete().where(Users.id == 'abc123')
@@ -371,6 +374,11 @@ sql, params = query.render()
 # Multiple conditions
 query = Users.delete().where(Users.age < 18).where(Users.active == False)
 
+# Explicitly delete all rows (use with extreme caution!)
+query = Users.delete().all_rows()
+sql, params = query.render()
+# ('DELETE FROM users', [])
+
 # With RETURNING (Postgres/SQLite)
 query = Users.delete().where(Users.id == 'abc123').returning()
 # ('DELETE FROM users WHERE users.id = ? RETURNING *', ['abc123'])
@@ -626,6 +634,27 @@ sql, _ = tsql.render(t"SELECT * FROM users WHERE name = {malicious}", style=tsql
 
 **Important:** While effective, parameterization is always preferred when available. Use `ESCAPED` only when necessary.
 
+### 4. Query Builder Safety: UPDATE/DELETE Protection
+
+The query builder prevents accidental mass UPDATE/DELETE operations by requiring an explicit WHERE clause or `.all_rows()` call:
+
+```python
+from tsql import UnsafeQueryError
+
+# This raises UnsafeQueryError at render time
+Users.update(status='inactive').render()  # ❌ Error!
+Users.delete().render()  # ❌ Error!
+
+# Must add WHERE clause
+Users.update(status='inactive').where(Users.id == user_id).render()  # ✅
+
+# Or explicitly confirm mass operation
+Users.update(status='inactive').all_rows().render()  # ✅
+Users.delete().all_rows().render()  # ✅
+```
+
+This protection catches the most common and dangerous SQL mistake: forgetting the WHERE clause. 
+
 ## Danger Zones: Where You Can Still Get Hurt
 
 ### The :unsafe Format Spec

{t_sql-3.1.0 → t_sql-3.2.0}/README.md

@@ -323,10 +323,9 @@ query = (Users.insert(id='abc123', username='john', email='john@example.com')
 ### UPDATE
 
 ```python
-# Basic update (no WHERE = updates all rows!)
+# UPDATE requires WHERE clause or explicit .all_rows() for safety
 query = Users.update(email='newemail@example.com')
-sql, params = query.render()
-# ('UPDATE users SET email = ?', ['newemail@example.com'])
+# ❌ Raises UnsafeQueryError: UPDATE without WHERE requires .all_rows()
 
 # UPDATE with WHERE
 query = Users.update(email='newemail@example.com').where(Users.id == 'abc123')
@@ -338,6 +337,11 @@ query = (Users.update(email='newemail@example.com')
          .where(Users.id == 'abc123')
          .where(Users.age > 18))
 
+# Explicitly update all rows (use with caution!)
+query = Users.update(status='inactive').all_rows()
+sql, params = query.render()
+# ('UPDATE users SET status = ?', ['inactive'])
+
 # With RETURNING (Postgres/SQLite)
 query = (Users.update(email='new@example.com')
          .where(Users.id == 'abc123')
@@ -348,10 +352,9 @@ query = (Users.update(email='new@example.com')
 ### DELETE
 
 ```python
-# Basic delete (no WHERE = deletes all rows!)
+# DELETE requires WHERE clause or explicit .all_rows() for safety
 query = Users.delete()
-sql, params = query.render()
-# ('DELETE FROM users', [])
+# ❌ Raises UnsafeQueryError: DELETE without WHERE requires .all_rows()
 
 # DELETE with WHERE
 query = Users.delete().where(Users.id == 'abc123')
@@ -361,6 +364,11 @@ sql, params = query.render()
 # Multiple conditions
 query = Users.delete().where(Users.age < 18).where(Users.active == False)
 
+# Explicitly delete all rows (use with extreme caution!)
+query = Users.delete().all_rows()
+sql, params = query.render()
+# ('DELETE FROM users', [])
+
 # With RETURNING (Postgres/SQLite)
 query = Users.delete().where(Users.id == 'abc123').returning()
 # ('DELETE FROM users WHERE users.id = ? RETURNING *', ['abc123'])
@@ -616,6 +624,27 @@ sql, _ = tsql.render(t"SELECT * FROM users WHERE name = {malicious}", style=tsql
 
 **Important:** While effective, parameterization is always preferred when available. Use `ESCAPED` only when necessary.
 
+### 4. Query Builder Safety: UPDATE/DELETE Protection
+
+The query builder prevents accidental mass UPDATE/DELETE operations by requiring an explicit WHERE clause or `.all_rows()` call:
+
+```python
+from tsql import UnsafeQueryError
+
+# This raises UnsafeQueryError at render time
+Users.update(status='inactive').render()  # ❌ Error!
+Users.delete().render()  # ❌ Error!
+
+# Must add WHERE clause
+Users.update(status='inactive').where(Users.id == user_id).render()  # ✅
+
+# Or explicitly confirm mass operation
+Users.update(status='inactive').all_rows().render()  # ✅
+Users.delete().all_rows().render()  # ✅
+```
+
+This protection catches the most common and dangerous SQL mistake: forgetting the WHERE clause. 
+
 ## Danger Zones: Where You Can Still Get Hurt
 
 ### The :unsafe Format Spec

{t_sql-3.1.0 → t_sql-3.2.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "t-sql"
-version = "3.1.0"
+version = "3.2.0"
 description = "Safe SQL. SQL queries for python t-strings (PEP 750)"
 readme = "README.md"
 requires-python = ">=3.14"

{t_sql-3.1.0 → t_sql-3.2.0}/tests/test_query_builder.py

@@ -1172,7 +1172,7 @@ def test_returning_cols_validation_update():
     import pytest
 
     # Test with malicious returning column
-    query = Users.update(username='hacked')
+    query = Users.update(username='hacked').all_rows()
     builder = query.returning("id, (SELECT password FROM admin_users LIMIT 1) AS stolen")
 
     with pytest.raises(ValueError, match="Invalid RETURNING column name"):
@@ -1191,7 +1191,7 @@ def test_returning_cols_validation_delete():
     import pytest
 
     # Test with malicious returning column
-    query = Users.delete()
+    query = Users.delete().all_rows()
     builder = query.returning("* FROM users; DROP TABLE secrets; --")
 
     with pytest.raises(ValueError, match="Invalid RETURNING column name"):
@@ -1222,3 +1222,46 @@ def test_conflict_cols_list_validation():
     sql, params = builder2.render()
 
     assert 'ON CONFLICT (id, email)' in sql
+
+
+def test_update_without_where_raises_error():
+    """Test that UPDATE without WHERE clause raises UnsafeQueryError"""
+    import pytest
+    from tsql.query_builder import UnsafeQueryError
+
+    builder = Users.update(username='updated')
+
+    with pytest.raises(UnsafeQueryError, match="UPDATE without WHERE clause requires explicit .all_rows()"):
+        builder.render()
+
+
+def test_update_with_all_rows_works():
+    """Test that UPDATE with .all_rows() bypasses safety check"""
+    builder = Users.update(username='updated').all_rows()
+    sql, params = builder.render()
+
+    assert 'UPDATE users SET' in sql
+    assert 'username = ?' in sql
+    assert 'WHERE' not in sql
+    assert params == ['updated']
+
+
+def test_delete_without_where_raises_error():
+    """Test that DELETE without WHERE clause raises UnsafeQueryError"""
+    import pytest
+    from tsql.query_builder import UnsafeQueryError
+
+    builder = Users.delete()
+
+    with pytest.raises(UnsafeQueryError, match="DELETE without WHERE clause requires explicit .all_rows()"):
+        builder.render()
+
+
+def test_delete_with_all_rows_works():
+    """Test that DELETE with .all_rows() bypasses safety check"""
+    builder = Users.delete().all_rows()
+    sql, params = builder.render()
+
+    assert 'DELETE FROM users' in sql
+    assert 'WHERE' not in sql
+    assert params == []

{t_sql-3.1.0 → t_sql-3.2.0}/tsql/__init__.py

@@ -360,6 +360,8 @@ def delete(table: str, id: str | int) -> TSQL:
     return TSQL(t"DELETE FROM {table:literal} WHERE id = {id}")
 
 
+from tsql.query_builder import UnsafeQueryError
+
 __all__ = [
     'TSQL',
     'TSQLQuery',
@@ -370,5 +372,6 @@ __all__ = [
     'update',
     'delete',
     'set_style',
+    'UnsafeQueryError',
 ]
 

{t_sql-3.1.0 → t_sql-3.2.0}/tsql/query_builder.py

@@ -5,6 +5,14 @@ from abc import ABC, abstractmethod
 
 from tsql import TSQL, t_join
 
+
+class UnsafeQueryError(Exception):
+    """Raised when attempting to render an UPDATE or DELETE query without a WHERE clause.
+
+    To perform mass updates or deletes, explicitly call .all_rows() to confirm intent.
+    """
+    pass
+
 # Optional SQLAlchemy support
 try:
     from sqlalchemy import MetaData, Table as SATable, Column as SAColumn
@@ -687,10 +695,27 @@ class UpdateBuilder(QueryBuilder):
 
         self._conditions: List[Union[Condition, Template]] = []
         self._returning_cols: Optional[List[str]] = None
+        self._requires_where: bool = True
 
     def where(self, condition: Union[Condition, Template]) -> 'UpdateBuilder':
         """Add a WHERE condition (multiple calls are ANDed together)"""
         self._conditions.append(condition)
+        self._requires_where = False
+        return self
+
+    def all_rows(self) -> 'UpdateBuilder':
+        """Explicitly confirm intent to update all rows without a WHERE clause.
+
+        By default, UPDATE queries without WHERE clauses will raise UnsafeQueryError
+        at render time. Call this method to bypass that safety check.
+
+        Returns:
+            self for method chaining
+
+        Example:
+            Users.update(status='inactive').all_rows()
+        """
+        self._requires_where = False
         return self
 
     def returning(self, *columns: str) -> 'UpdateBuilder':
@@ -736,6 +761,11 @@ class UpdateBuilder(QueryBuilder):
 
     def render(self, style=None):
         """Convenience method to render the query directly"""
+        if self._requires_where:
+            raise UnsafeQueryError(
+                "UPDATE without WHERE clause requires explicit .all_rows() call to confirm intent. "
+                "This prevents accidentally updating all rows in the table."
+            )
         return self.to_tsql().render(style)
 
     def __repr__(self) -> str:
@@ -756,10 +786,27 @@ class DeleteBuilder(QueryBuilder):
         self.base_table = base_table
         self._conditions: List[Union[Condition, Template]] = []
         self._returning_cols: Optional[List[str]] = None
+        self._requires_where: bool = True
 
     def where(self, condition: Union[Condition, Template]) -> 'DeleteBuilder':
         """Add a WHERE condition (multiple calls are ANDed together)"""
         self._conditions.append(condition)
+        self._requires_where = False
+        return self
+
+    def all_rows(self) -> 'DeleteBuilder':
+        """Explicitly confirm intent to delete all rows without a WHERE clause.
+
+        By default, DELETE queries without WHERE clauses will raise UnsafeQueryError
+        at render time. Call this method to bypass that safety check.
+
+        Returns:
+            self for method chaining
+
+        Example:
+            Users.delete().all_rows()
+        """
+        self._requires_where = False
         return self
 
     def returning(self, *columns: str) -> 'DeleteBuilder':
@@ -804,6 +851,11 @@ class DeleteBuilder(QueryBuilder):
 
     def render(self, style=None):
         """Convenience method to render the query directly"""
+        if self._requires_where:
+            raise UnsafeQueryError(
+                "DELETE without WHERE clause requires explicit .all_rows() call to confirm intent. "
+                "This prevents accidentally deleting all rows in the table."
+            )
         return self.to_tsql().render(style)
 
     def __repr__(self) -> str: