timber-common 1.2.1__tar.gz → 1.2.2__tar.gz

{timber_common-1.2.1 → timber_common-1.2.2}/CHANGELOG.md

@@ -5,6 +5,14 @@ All notable changes to Timber will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.2.2] - 2026-10-24
+
+### Fixed
+
+- Reject malformed and unknown database filters instead of dropping their predicates.
+- Require non-empty filter dictionaries for updates and deletes, and preserve null
+  filters as SQL `IS NULL` predicates so a scoped mutation cannot become table-wide.
+
 ## [1.2.1] - 2026-10-06
 
 ### Fixed

{timber_common-1.2.1 → timber_common-1.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: timber-common
-Version: 1.2.1
+Version: 1.2.2
 Summary: Configuration-driven persistence library with ml tools (finance related) config driven db model registration, llm model choice, automatic encryption, caching, vector search, and GDPR compliance for Python applications
 License: Apache-2.0
 Keywords: orm,sqlalchemy,persistence,vector-search,semantic-search,encryption,gdpr,yaml-config,postgres,redis,configuration-driven,data-modeling,machine-learning,embeddings

{timber_common-1.2.1 → timber_common-1.2.2}/common/services/db_service.py

@@ -323,29 +323,18 @@ class DBService:
     
     def _apply_filters(self, query, model_class: Type, filters: Dict[str, Any]):
         """Apply filters to query."""
-        # Handle None or empty filters
-        if not filters:
-            return query
-        
-        # Handle string filters (invalid input - return unfiltered)
-        if isinstance(filters, str):
-            logger.warning(f"Received string filters instead of dict: {filters}")
-            return query
-        
-        # Handle non-dict filters
+        if filters is None:
+            filters = {}
         if not isinstance(filters, dict):
-            logger.warning(f"Received non-dict filters: {type(filters)}")
-            return query
-        
-        # Apply filters
+            raise ValueError("Filters must be a dict")
+        unknown = [field for field in filters if not hasattr(model_class, field)]
+        if unknown:
+            raise ValueError(f"Unknown filter fields: {', '.join(map(str, unknown))}")
         for field, value in filters.items():
-            if value is not None:  # Skip None values
-                if hasattr(model_class, field):
-                    query = query.filter(getattr(model_class, field) == value)
-                else:
-                    logger.warning(f"Model {model_class.__name__} has no field '{field}'")
+            # SQLAlchemy translates None to IS NULL; dropping it broadens scope.
+            query = query.filter(getattr(model_class, field) == value)
         return query
-    
+
     def _apply_ordering(self, query, model_class: Type, order_by):
         """Apply ordering to a query.
 
@@ -462,8 +451,7 @@ class DBService:
             logger.warning(f"Filters passed as string, using empty filters. Got: {filters}")
             filters = {}
         elif not isinstance(filters, dict):
-            logger.warning(f"Filters not a dict (type: {type(filters)}), using empty filters")
-            filters = {}
+            raise ValueError("Filters must be a dict")
         
         if include_relationships is None:
             include_relationships = []
@@ -594,6 +582,9 @@ class DBService:
                 data={'status': 'completed'}
             )
         """
+        if not isinstance(filters, dict) or not filters:
+            raise ValueError("Mutations require a non-empty filter dict")
+
         model_class = self._get_model_class(model)
         
         with self.session_scope() as session:
@@ -627,6 +618,9 @@ class DBService:
                 filters={'id': 'goal-123'}
             )
         """
+        if not isinstance(filters, dict) or not filters:
+            raise ValueError("Mutations require a non-empty filter dict")
+
         model_class = self._get_model_class(model)
         
         with self.session_scope() as session:

{timber_common-1.2.1 → timber_common-1.2.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "timber-common"
-version = "1.2.1"
+version = "1.2.2"
 description = "Configuration-driven persistence library with ml tools (finance related) config driven db model registration, llm model choice, automatic encryption, caching, vector search, and GDPR compliance for Python applications"
 authors = ["Pumulo Sikaneta <pumulo@gmail.com>"]
 maintainers = ["Pumulo Sikaneta <pumulo@gmail.com>"]