velocity-python 0.1.2__tar.gz → 0.1.4__tar.gz

{velocity_python-0.1.2 → velocity_python-0.1.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: velocity-python
-Version: 0.1.2
+Version: 0.1.4
 Summary: A rapid application development library for interfacing with data storage
 Author-email: Velocity Team <info@codeclubs.org>
 License-Expression: MIT

{velocity_python-0.1.2 → velocity_python-0.1.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "velocity-python"
-version = "0.1.2"
+version = "0.1.4"
 authors = [
   { name="Velocity Team", email="info@codeclubs.org" },
 ]

{velocity_python-0.1.2 → velocity_python-0.1.4}/src/velocity/__init__.py

@@ -1,4 +1,4 @@
-__version__ = version = "0.1.2"
+__version__ = version = "0.1.4"
 
 import importlib as _importlib
 

{velocity_python-0.1.2 → velocity_python-0.1.4}/src/velocity/db/core/column.py

@@ -125,8 +125,9 @@ class Column:
         Returns the MAX() of this column, or 0 if table/column is missing.
         """
         try:
+            qcol = self.sql.quote_identifier(self.name)
             sql, vals = self.sql.select(
-                columns=f"max({self.name})", table=self.table.name, where=where
+                columns=f"max({qcol})", table=self.table.name, where=where
             )
             return self.tx.execute(sql, vals).scalar()
         except (exceptions.DbTableMissingError, exceptions.DbColumnMissingError):

{velocity_python-0.1.2 → velocity_python-0.1.4}/src/velocity/db/core/decorators.py

@@ -121,6 +121,12 @@ def return_default(
                     e,
                 )
 
+                # R12 — Increment per-transaction counter for swallowed exceptions.
+                try:
+                    self.tx._return_default_count = getattr(self.tx, "_return_default_count", 0) + 1
+                except Exception:
+                    pass
+
                 # Capture swallowed exceptions for upstream diagnostics.
                 # This decorator intentionally returns a default value instead of
                 # raising, but consumers (e.g. API handlers) may still want to

{velocity_python-0.1.2 → velocity_python-0.1.4}/src/velocity/db/core/engine.py

@@ -7,7 +7,7 @@ from contextlib import contextmanager
 from functools import wraps
 from velocity.db import exceptions
 from velocity.db.core.transaction import Transaction
-from velocity.db.utils import mask_config_for_display
+from velocity.db.utils import mask_config_for_display, mask_sensitive_in_string
 
 import logging
 
@@ -77,6 +77,7 @@ class ConnectionPool:
         if self._closed:
             raise exceptions.DbConnectionError("Connection pool is closed")
 
+        t0 = time.perf_counter()
         self._available.acquire()  # blocks when maxconn reached
 
         with self._lock:
@@ -84,7 +85,11 @@ class ConnectionPool:
             while self._pool:
                 conn = self._pool.pop()
                 if self._is_alive(conn):
-                    logger.debug("Pool: reusing idle connection (pool_size=%d)", len(self._pool))
+                    elapsed_ms = (time.perf_counter() - t0) * 1000
+                    logger.debug(
+                        "Pool: reusing idle connection (pool_size=%d, wait=%.1f ms)",
+                        len(self._pool), elapsed_ms,
+                    )
                     return conn
                 # Dead connection — close it silently and create a fresh one.
                 logger.debug("Pool: discarding dead idle connection")
@@ -95,7 +100,11 @@ class ConnectionPool:
             try:
                 conn = self._connect_fn()
                 self._total_created += 1
-                logger.debug("Pool: created new connection (total=%d)", self._total_created)
+                elapsed_ms = (time.perf_counter() - t0) * 1000
+                logger.debug(
+                    "Pool: created new connection (total=%d, wait=%.1f ms)",
+                    self._total_created, elapsed_ms,
+                )
                 return conn
             except Exception:
                 self._available.release()
@@ -277,10 +286,12 @@ class Engine:
         If pooling is enabled, borrows from the pool.
         If the database is missing, tries to create it, then reconnect.
         """
+        t0 = time.perf_counter()
         if self.__pool:
             try:
                 conn = self.__pool.getconn()
-                logger.debug("Engine.connect: obtained pooled connection")
+                elapsed_ms = (time.perf_counter() - t0) * 1000
+                logger.debug("Engine.connect: obtained pooled connection (%.1f ms)", elapsed_ms)
                 return conn
             except exceptions.DbDatabaseMissingError:
                 self.create_database()
@@ -291,7 +302,8 @@ class Engine:
 
         try:
             conn = self._raw_connect()
-            logger.debug("Engine.connect: created direct connection")
+            elapsed_ms = (time.perf_counter() - t0) * 1000
+            logger.debug("Engine.connect: created direct connection (%.1f ms)", elapsed_ms)
         except exceptions.DbDatabaseMissingError:
             self.create_database()
             conn = self._raw_connect()
@@ -496,6 +508,53 @@ class Engine:
             # if depth == 0:
             #     delattr(_tx, "_exec_function_depth")
 
+    def perf_log(self, func):
+        """
+        Decorator that logs wall time, query count, and total query time
+        for a ``@engine.transaction``-wrapped function.
+
+        Usage::
+
+            @engine.perf_log
+            @engine.transaction
+            def some_work(tx):
+                ...
+
+        The ``tx`` parameter **must** be a keyword argument or the first
+        positional ``Transaction`` so we can read its counters.
+        """
+
+        @wraps(func)
+        def wrapper(*args, **kwds):
+            t0 = time.perf_counter()
+            result = func(*args, **kwds)
+            wall_ms = (time.perf_counter() - t0) * 1000
+
+            # Find the Transaction among the arguments.
+            tx = kwds.get("tx")
+            if tx is None:
+                for a in args:
+                    if isinstance(a, Transaction):
+                        tx = a
+                        break
+
+            qcount = getattr(tx, "_query_count", 0) if tx else 0
+            qtime = getattr(tx, "_query_time_ms", 0.0) if tx else 0.0
+
+            logger.info(
+                "perf_log %s: wall=%.1f ms, queries=%d, query_time=%.1f ms",
+                getattr(func, "__qualname__", func.__name__),
+                wall_ms, qcount, qtime,
+                extra={
+                    "wall_ms": round(wall_ms, 1),
+                    "query_count": qcount,
+                    "query_time_ms": round(qtime, 1),
+                },
+            )
+            return result
+
+        return wrapper
+
     @property
     def driver(self):
         return self.__driver
@@ -714,6 +773,10 @@ class Engine:
         if relevant_frames:
             enhanced_message += "\n\nCall Context:\n" + "".join(relevant_frames)
 
+        # Mask any credentials that may have leaked into driver error messages
+        # (e.g. connection strings containing password=...).
+        enhanced_message = mask_sensitive_in_string(enhanced_message)
+
         # Note: SQL formatting for logging is available via _format_sql_with_params,
         # but we intentionally avoid eager logging here.
 

{velocity_python-0.1.2 → velocity_python-0.1.4}/src/velocity/db/core/table.py

@@ -1,3 +1,4 @@
+import logging
 import re
 import warnings
 import sqlparse
@@ -12,6 +13,8 @@ from velocity.db.core.decorators import (
     reset_id_on_dup_key,
 )
 
+_ddl_logger = logging.getLogger(__name__)
+
 
 class Query:
     """
@@ -252,6 +255,7 @@ class Table:
         )
         if kwds.get("sql_only", False):
             return sql, vals
+        _ddl_logger.warning("DDL CREATE INDEX on %s columns=%s unique=%s", self.name, columns, unique)
         self.tx.execute(sql, vals, cursor=self.cursor())
 
     def create_indexes(self, indexes, **kwds):
@@ -317,6 +321,7 @@ class Table:
         sql, vals = self.sql.drop_index(self.name, columns)
         if kwds.get("sql_only", False):
             return sql, vals
+        _ddl_logger.warning("DDL DROP INDEX on %s columns=%s", self.name, columns)
         self.tx.execute(sql, vals, cursor=self.cursor())
 
     @return_default(None)
@@ -325,6 +330,7 @@ class Table:
         Drops a column from this table.
         """
         sql, vals = self.sql.drop_column(self.name, column)
+        _ddl_logger.warning("DDL DROP COLUMN %s on %s", column, self.name)
         self.tx.execute(sql, vals, cursor=self.cursor())
 
     def create(self, columns=None, drop=False):
@@ -334,6 +340,7 @@ class Table:
         """
         columns = columns or {}
         sql, vals = self.sql.create_table(self.name, columns, drop)
+        _ddl_logger.warning("DDL CREATE TABLE %s columns=%s drop=%s", self.name, list(columns.keys()), drop)
         self.tx.execute(sql, vals, cursor=self.cursor())
 
     def drop(self):
@@ -341,6 +348,7 @@ class Table:
         Drops this table if it exists.
         """
         sql, vals = self.sql.drop_table(self.name)
+        _ddl_logger.warning("DDL DROP TABLE %s", self.name)
         self.tx.execute(sql, vals, cursor=self.cursor())
 
     def exists(self):
@@ -625,6 +633,7 @@ class Table:
         )
         if kwds.get("sql_only", False):
             return sql, vals
+        _ddl_logger.warning("DDL CREATE FOREIGN KEY on %s columns=%s ref=%s(%s)", self.name, columns, key_to_table, key_to_columns)
         return self.tx.execute(sql, vals, cursor=self.cursor())
 
     def drop_foreign_key(self, columns, key_to_table, key_to_columns="sys_id", **kwds):
@@ -636,6 +645,7 @@ class Table:
         )
         if kwds.get("sql_only", False):
             return sql, vals
+        _ddl_logger.warning("DDL DROP FOREIGN KEY on %s columns=%s ref=%s(%s)", self.name, columns, key_to_table, key_to_columns)
         return self.tx.execute(sql, vals, cursor=self.cursor())
 
     def rename(self, name, **kwds):
@@ -645,6 +655,7 @@ class Table:
         sql, vals = self.sql.rename_table(self.name, name)
         if kwds.get("sql_only", False):
             return sql, vals
+        _ddl_logger.warning("DDL RENAME TABLE %s to %s", self.name, name)
         self.tx.execute(sql, vals, cursor=self.cursor())
         self.name = name
 
@@ -784,6 +795,7 @@ class Table:
                 return statements[0]
             return statements
 
+        _ddl_logger.warning("DDL ALTER TABLE %s columns=%s mode=%s", self.name, list(columns.keys()), mode)
         for sql, vals in statements:
             if not sql:
                 continue
@@ -808,6 +820,7 @@ class Table:
         )
         if kwds.get("sql_only", False):
             return sql, vals
+        _ddl_logger.warning("DDL ALTER COLUMN TYPE on %s column=%s", self.name, column)
         self.tx.execute(sql, vals, cursor=self.cursor())
 
     @create_missing
@@ -1069,9 +1082,10 @@ class Table:
         """
         Returns the sum of the given column across rows matching `where`.
         """
+        qcol = self.sql.quote_identifier(column)
         sql, vals = self.sql.select(
             self.tx,
-            columns=f"coalesce(sum(coalesce({column},0)),0)",
+            columns=f"coalesce(sum(coalesce({qcol},0)),0)",
             table=self.name,
             where=where,
         )
@@ -1322,6 +1336,7 @@ class Table:
         )
         if kwds.get("sql_only", False):
             return sql, vals
+        _ddl_logger.warning("DDL CREATE VIEW %s temp=%s", name, temp)
         return self.tx.execute(sql, vals)
 
     def drop_view(self, name, silent=True, **kwds):
@@ -1331,6 +1346,7 @@ class Table:
         sql, vals = self.sql.drop_view(name=name, silent=silent)
         if kwds.get("sql_only", False):
             return sql, vals
+        _ddl_logger.warning("DDL DROP VIEW %s", name)
         return self.tx.execute(sql, vals)
 
     def alter_trigger(self, name="USER", state="ENABLE", **kwds):
@@ -1340,6 +1356,7 @@ class Table:
         sql, vals = self.sql.alter_trigger(table=self.name, state=state, name=name)
         if kwds.get("sql_only", False):
             return sql, vals
+        _ddl_logger.warning("DDL ALTER TRIGGER %s on %s state=%s", name, self.name, state)
         return self.tx.execute(sql, vals)
 
     def rename_column(self, orig, new, **kwds):
@@ -1349,6 +1366,7 @@ class Table:
         sql, vals = self.sql.rename_column(table=self.name, orig=orig, new=new)
         if kwds.get("sql_only", False):
             return sql, vals
+        _ddl_logger.warning("DDL RENAME COLUMN on %s %s -> %s", self.name, orig, new)
         return self.tx.execute(sql, vals)
 
     def set_sequence(self, next_value=1000, **kwds):
@@ -1358,6 +1376,7 @@ class Table:
         sql, vals = self.sql.set_sequence(table=self.name, next_value=next_value)
         if kwds.get("sql_only", False):
             return sql, vals
+        _ddl_logger.warning("DDL SET SEQUENCE on %s next_value=%s", self.name, next_value)
         return self.tx.execute(sql, vals).scalar()
 
     def get_sequence(self, **kwds):
@@ -1396,8 +1415,9 @@ class Table:
         """
         Returns the MAX() of the specified column.
         """
+        qcol = self.sql.quote_identifier(column)
         sql, vals = self.sql.select(
-            self.tx, columns=f"max({column})", table=self.name, where=where
+            self.tx, columns=f"max({qcol})", table=self.name, where=where
         )
         if kwds.get("sql_only", False):
             return sql, vals
@@ -1408,8 +1428,9 @@ class Table:
         """
         Returns the MIN() of the specified column.
         """
+        qcol = self.sql.quote_identifier(column)
         sql, vals = self.sql.select(
-            self.tx, columns=f"min({column})", table=self.name, where=where
+            self.tx, columns=f"min({qcol})", table=self.name, where=where
         )
         if kwds.get("sql_only", False):
             return sql, vals

{velocity_python-0.1.2 → velocity_python-0.1.4}/src/velocity/db/core/transaction.py

@@ -1,4 +1,6 @@
+import logging
 import os
+import time as _time
 import traceback
 from collections import OrderedDict
 
@@ -14,9 +16,60 @@ from velocity.misc.db import randomword
 
 debug = False
 
+_logger = logging.getLogger("velocity.db.transaction")
+
 # Default maximum number of cached query results per transaction.
 _DEFAULT_QUERY_CACHE_SIZE = int(os.environ.get("VELOCITY_QUERY_CACHE_SIZE", "100"))
 
+# Slow-query threshold in milliseconds (0 = disabled).
+_SLOW_QUERY_MS = int(os.environ.get("VELOCITY_SLOW_QUERY_MS", "500"))
+
+_SQL_OP_PREFIXES = {
+    "select": "SELECT",
+    "insert": "INSERT",
+    "update": "UPDATE",
+    "delete": "DELETE",
+    "create": "DDL",
+    "alter": "DDL",
+    "drop": "DDL",
+    "set": "SET",
+}
+
+
+def _classify_sql(sql):
+    """Return a short operation label (SELECT, INSERT, …) from a SQL string."""
+    if not sql:
+        return "OTHER"
+    first = sql.lstrip().split(None, 1)[0].lower() if sql.strip() else ""
+    return _SQL_OP_PREFIXES.get(first, "OTHER")
+
+
+def _extract_table_name(sql):
+    """Best-effort extraction of the main table name from a SQL statement."""
+    if not sql:
+        return None
+    upper = sql.strip().upper()
+    lowered = sql.strip()
+    try:
+        if upper.startswith("SELECT"):
+            idx = upper.find(" FROM ")
+            if idx != -1:
+                rest = lowered[idx + 6:].strip()
+                return rest.split()[0].strip('"').strip("'") if rest else None
+        elif upper.startswith("INSERT"):
+            idx = upper.find(" INTO ")
+            if idx != -1:
+                rest = lowered[idx + 6:].strip()
+                return rest.split()[0].strip('"').strip("'") if rest else None
+        elif upper.startswith(("UPDATE", "DELETE FROM")):
+            parts = lowered.split()
+            if len(parts) >= 2:
+                token = parts[2] if upper.startswith("DELETE") and len(parts) > 2 else parts[1]
+                return token.strip('"').strip("'")
+    except (IndexError, ValueError):
+        pass
+    return None
+
 
 class Transaction:
     """
@@ -32,6 +85,10 @@ class Transaction:
         # R5 — Transaction-scoped query cache (opt-in via cache=True on select).
         self.__query_cache: OrderedDict = OrderedDict()
         self.__query_cache_max = _DEFAULT_QUERY_CACHE_SIZE
+        # R12 — Observability counters.
+        self._query_count = 0
+        self._query_time_ms = 0.0
+        self._return_default_count = 0
 
     def __str__(self):
         config = mask_config_for_display(self.engine.config)
@@ -119,6 +176,7 @@ class Transaction:
         if prepare is None:
             prepare = getattr(self.engine, "prepare_enabled", False)
 
+        t0 = _time.perf_counter()
         try:
             if parms:
                 cursor.execute(sql, parms, prepare=prepare)
@@ -136,6 +194,24 @@ class Transaction:
         except Exception as e:
             raise self.engine.process_error(e, sql, parms)
 
+        elapsed_ms = (_time.perf_counter() - t0) * 1000
+        self._query_count += 1
+        self._query_time_ms += elapsed_ms
+
+        # R12 — Slow query logging.
+        if _SLOW_QUERY_MS and elapsed_ms > _SLOW_QUERY_MS:
+            op = _classify_sql(sql)
+            tbl = _extract_table_name(sql)
+            _logger.warning(
+                "Slow query (%s): %.1f ms table=%s",
+                op, elapsed_ms, tbl,
+                extra={
+                    "query_duration_ms": round(elapsed_ms, 1),
+                    "table_name": tbl,
+                    "operation": op,
+                },
+            )
+
         if single:
             self.connection.autocommit = False
 
@@ -195,6 +271,15 @@ class Transaction:
             if debug:
                 print(f"{id(self)} --- connection commit.")
             self.connection.commit()
+            if self._query_count:
+                _logger.debug(
+                    "Transaction commit: %d queries in %.1f ms",
+                    self._query_count, self._query_time_ms,
+                    extra={
+                        "query_count": self._query_count,
+                        "query_time_ms": round(self._query_time_ms, 1),
+                    },
+                )
 
     def rollback(self):
         """

{velocity_python-0.1.2 → velocity_python-0.1.4}/src/velocity/db/servers/base/sql.py

@@ -38,6 +38,16 @@ class BaseSQLDialect(ABC):
     DatabaseObjectExistsErrorCodes: List[str] = []
     DataIntegrityErrorCodes: List[str] = []
 
+    @classmethod
+    def quote_identifier(cls, name: str) -> str:
+        """Always-quote a single SQL identifier to prevent injection.
+
+        Uses standard SQL double-quoting.  Dialect subclasses override for
+        MySQL (backticks) and SQL Server (brackets).
+        """
+        escaped = name.replace('"', '""')
+        return f'"{escaped}"'
+
     @classmethod
     @abstractmethod
     def get_error(cls, e: Exception) -> Optional[str]:

{velocity_python-0.1.2 → velocity_python-0.1.4}/src/velocity/db/servers/mysql/sql.py

@@ -48,6 +48,11 @@ class SQL(BaseSQLDialect):
     type_column_identifier = "DATA_TYPE"
     is_nullable = "IS_NULLABLE"
 
+    @classmethod
+    def quote_identifier(cls, name: str) -> str:
+        escaped = name.replace('`', '``')
+        return f'`{escaped}`'
+
     default_schema = ""
 
     ApplicationErrorCodes = []

{velocity_python-0.1.2 → velocity_python-0.1.4}/src/velocity/db/servers/sqlserver/sql.py

@@ -48,6 +48,11 @@ class SQL(BaseSQLDialect):
     type_column_identifier = "DATA_TYPE"
     is_nullable = "IS_NULLABLE"
 
+    @classmethod
+    def quote_identifier(cls, name: str) -> str:
+        escaped = name.replace(']', ']]')
+        return f'[{escaped}]'
+
     default_schema = "dbo"
 
     # SQL Server error numbers

{velocity_python-0.1.2 → velocity_python-0.1.4}/src/velocity_python.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: velocity-python
-Version: 0.1.2
+Version: 0.1.4
 Summary: A rapid application development library for interfacing with data storage
 Author-email: Velocity Team <info@codeclubs.org>
 License-Expression: MIT

{velocity_python-0.1.2 → velocity_python-0.1.4}/src/velocity_python.egg-info/SOURCES.txt

@@ -159,6 +159,7 @@ tests/test_iconv_money_to_cents.py
 tests/test_lambda_handler.py
 tests/test_lambda_handler_auth.py
 tests/test_mixins_import.py
+tests/test_observability.py
 tests/test_payment_braintree_adapter.py
 tests/test_payment_demo_profiles.py
 tests/test_payment_profiles.py
@@ -169,6 +170,7 @@ tests/test_psycopg3_upgrade.py
 tests/test_query_cache.py
 tests/test_row_batch_update.py
 tests/test_row_cache_staleness.py
+tests/test_security_hardening.py
 tests/test_sqs_per_record_transactions.py
 tests/test_sys_modified_count_postgres_demo.py
 tests/test_table_alter.py