test: add pytest suite for AI assistant SQL guardrails, bump dependency pins - #6
Draft
HelloBryte wants to merge 1 commit into
Draft
test: add pytest suite for AI assistant SQL guardrails, bump dependency pins#6HelloBryte wants to merge 1 commit into
HelloBryte wants to merge 1 commit into
Conversation
…cy pins - Add tests/ covering utils/assistant_data.py's validate_sql() (SELECT-only allowlist, destructive-keyword blocklist, per-role table RBAC) and extract_sql_payload() JSON parsing — previously untested despite being the security boundary for the AI assistant's generated SQL. - Add requirements-dev.txt (pytest) and pytest.ini; document `pytest` usage in the README (English + Chinese). - Bump requirements.txt pins to current releases: PySide6 6.11.2, mysql-connector-python 26.7.0, python-dotenv 1.2.3 (verified importable against this repo's usage; httpx already at latest). - Fix stale doc drift in utils/project_knowledge.py: it described security.py as doing "password hashing" when the module is actually plain-text comparison for this experimental build — this text is fed directly into the AI assistant's prompt context.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Routine maintenance pass: this repo had zero test coverage, so this adds a first pytest suite for the one area that most needed it — the AI assistant's SQL guardrails — plus a few small drift/pin fixes found along the way.
tests/test_assistant_data.py, 15 cases, no DB needed): coversvalidate_sql()— the SELECT-only allowlist, destructive-keyword blocklist, and per-role table RBAC (adminvsuseraccess to theuserstable) — andextract_sql_payload()'s JSON parsing of model output, including a documented edge case (a single-brace JSON object embedded in prose currently isn't extracted; multi-brace/fenced cases are).requirements-dev.txt(pytest) andpytest.ini; documentedpytestusage in the README (English + Chinese sections).PySide66.10.3 → 6.11.2,mysql-connector-python9.4.0 → 26.7.0,python-dotenv1.1.1 → 1.2.3 (httpxwas already current at 0.28.1). Themysql-connector-pythonjump is a large version-number change (Oracle realigned its versioning scheme) — I verified it imports cleanly andMySQLConnectionPool/Error/cursor APIs used by this repo are unaffected, but there's no live MySQL server in this environment to run a full integration check against it.utils/project_knowledge.py(the text fed into the AI assistant's prompt context) describedutils/security.pyas doing "password hashing and verification," but that module is actually a plain-text comparison for this experimental build. Fixed the description to match reality so the assistant doesn't misrepresent the app's security posture to users.Test plan
pytest— 15/15 passing locallyutils/assistant_data.py(and itsdatabase.dbimport chain) imports cleanly againstmysql-connector-python==26.7.0with no live DB (pool creation fails gracefully, as designed)🤖 Generated with Claude Code
https://claude.ai/code/session_01GpjUyJ8dbmBvZz7EfaJYe5
Generated by Claude Code