[Bug]: curate dry-run / output=None executes tenant SQL without reject_non_single_select

[VARUN3WARE]

Version or commit

5b720ec

Environment

Linux x86_64, Python via uv; library + CLI repro

Minimal reproduction

On main @ 5b720ec, the single-SELECT gate only runs when writing a manifest.

1. Manifest path is gated — _stage_manifest_and_count calls reject_non_single_select(sql) before any DuckDB execute (src/hflow/curation.py ~705–709). The pinned surface in tests/test_catalog_curation.py (_SQL_SURFACE_PAYLOADS) covers multi-statement, DDL-only, PIVOT, PRAGMA/DESCRIBE/SHOW/SUMMARIZE, and the copy-escape shape.

2. Dry-run / report-only path is not gated:

# src/hflow/curation.py ~899–902
case None:
    (row_count,) = connection.execute(f"SELECT count(*) FROM ({sql})").fetchone() or (
        0,
    )

No reject_non_single_select before that execute.

3. CLI dry-run uses that path and never calls the gate itself:

# src/hflow/cli.py ~1489–1492
report = curate(
    arguments.catalog,
    sql,
    output=None if arguments.dry_run else arguments.output,
)

4. Contrast: the hosted server always rejects first, then calls curate(..., output=None) (packages/hflow-server/src/hflow_server/_curation.py ~367–391). Library/CLI dry-run skip that boundary.

5. Same injection SQL that manifest-write refuses (SELECT 1; CREATE TABLE pwned AS SELECT 1 AS x, or the _SQL_SURFACE_PAYLOADS copy-escape row that closes the wrapper paren early) is executed on the dry-run branch because the gate never runs. Dry-run wraps SQL as SELECT count(*) FROM ({sql}), so copy-escape shapes that close that paren are especially relevant.

Not covered by the current open board: #558, #545, #528, #498, #491, #481 (open PR #542 is the redundant-parse cleanup, not this missing gate), #376, #287, #246. Open PRs #562 / #542 / #517 / #380 / #142 do not close this seam.

Expected behavior

Every curate() path that executes tenant SQL — including output=None / hflow curate --dry-run — should run reject_non_single_select (or share the same helper) before connection.execute / connection.sql, matching the manifest-write path and the server boundary.

Refused shapes from _SQL_SURFACE_PAYLOADS must raise NonSingleSelectQueryError / ValueError on dry-run the same way they do on manifest write, with no side-effect tables/files.

Actual behavior

reject_non_single_select is only invoked from _stage_manifest_and_count. Report-only curation skips it. HOSTING.md / CATALOG.md tell operators that curate(..., constrained=True) is the tenant SQL posture; that locks file access but does not apply the statement-count gate on the dry-run branch.

Additional context

Definition of done

• Call reject_non_single_select(sql) before the case None: count query in curate() (preferred: one place so every destination path stays consistent).
• Extend the SQL-surface tests (or a sibling) so curate(..., output=None) / CLI --dry-run refuse the same _SQL_SURFACE_PAYLOADS injection rows as _stage_manifest_and_count.
• Optional docs: note in HOSTING/CATALOG that the statement gate applies to report-only curate too, not only manifest materialization.

Non-goals

• Redesigning The curation gate parses every query twice, and the second parse refuses nothing #481 / fix(curation): remove redundant wrapper parse in reject_non_single_select #542 (redundant parse on the already-gated path).
• Changing DuckDB constrained allowlists.
• New curation features.

[kstonekuan]

Confirmed. reject_non_single_select is called only from _stage_manifest_and_count (curation.py:706), and the case None: branch at curation.py:899-902 executes straight into DuckDB.

Measured against the repo's own _SQL_SURFACE_PAYLOADS, running each down both paths:

payload	manifest write	dry run
PIVOT episodes ON status USING count(*)	refused	executes
DESCRIBE SELECT episode_id FROM episodes	refused	executes
SUMMARIZE SELECT episode_id FROM episodes	refused	executes
SELECT 1; CREATE TABLE pwned AS SELECT 1 AS x	refused	ParserException
CREATE TABLE t(x INT)	refused	ParserException
PRAGMA database_list	refused	ParserException

Two things worth carrying into the fix. The multi-statement and DDL shapes are not refused, they are tripping over the SELECT count(*) FROM ({sql}) wrapper and surfacing a raw DuckDB ParserException instead of NonSingleSelectQueryError, which is incidental rather than a guarantee. And PIVOT is the sharp one: the comment on that row in test_catalog_curation.py records that DuckDB rewrites it to CREATE then SELECT, so the dry-run path runs a CREATE.

The fix is the one you describe: call the same gate before the case None: execute so both paths raise the same error for the same set.

Not labelling good first issue, the pool is paused.