fix(demo): blank inert Cypher syntax before the session-scope check

The engine ignores `/* ... */` and `// ...` spans, so a predicate written
inside one restricts nothing. The guard read such a span as a live
predicate, and `WHERE true /* n.session = $sess */ RETURN n` passed the
check and then read every session, which is the whole thing the guard
exists to prevent.

Those spans and quoted strings are now blanked in a single left-to-right
pass, so whichever opens first wins: `//` inside a string literal stays
part of the string, and a quote inside an ignored span opens nothing. Both
forms join the queries the notebook asserts on, alongside two that keep a
genuine predicate standing next to an ignored span.

Author: polaz

demo/notebooks/03_langgraph_agent.ipynb

@@ -178,17 +178,25 @@
     "# require parsing the Cypher AST, which is out of scope for a demo safety guard.\n",
     "# In production code, use server-side row-level security instead of client regex.\n",
     "# Scope guards. Presence is not enough: the session predicate has to sit\n",
-    "# inside the WHERE clause it claims to restrict, and it must be real syntax\n",
-    "# rather than text. Three ways a query slipped past an earlier version:\n",
+    "# inside the WHERE clause it claims to restrict, and it must be live syntax\n",
+    "# rather than text the engine ignores. Four ways a query slipped past an\n",
+    "# earlier version:\n",
     "#\n",
     "#   WITH n, n.session = $sess AS unused WHERE true   equality before the WHERE\n",
     "#   WHERE true RETURN n, n.session = $sess AS scoped equality after it, in RETURN\n",
     "#   RETURN n AS `WHERE n.session = $sess`            the whole thing quoted\n",
+    "#   WHERE true /* n.session = $sess */               commented out, so ignored\n",
     "#\n",
-    "# So quoted spans are blanked first, and the search is bounded to the WHERE\n",
-    "# clause: from the keyword to whichever clause opens next. Every pattern below\n",
-    "# excludes its own delimiters, so none backtracks across a long query.\n",
-    "_QUOTED_RE = re.compile(r\"'[^']*'|\\\"[^\\\"]*\\\"|`[^`]*`\")\n",
+    "# Quoted spans and comments are therefore blanked in one left-to-right pass:\n",
+    "# whichever opens first wins, so `//` inside a string stays part of the string\n",
+    "# and a quote inside a comment does not open one. The search is then bounded\n",
+    "# to the WHERE clause, from the keyword to whichever clause opens next. Every\n",
+    "# pattern below excludes its own delimiters, so none backtracks across a long\n",
+    "# query.\n",
+    "_MASKED_RE = re.compile(\n",
+    "    r\"'[^']*'|\\\"[^\\\"]*\\\"|`[^`]*`|/\\*.*?\\*/|//[^\\n]*\",\n",
+    "    re.DOTALL,\n",
+    ")\n",
     "_WHERE_RE = re.compile(r\"\\bWHERE\\b\", re.IGNORECASE)\n",
     "_CLAUSE_START_RE = re.compile(\n",
     "    r\"\\b(RETURN|WITH|MATCH|OPTIONAL|ORDER\\s+BY|SKIP|LIMIT|UNION|CALL|MERGE\"\n",
@@ -202,6 +210,12 @@
     ")\n",
     "\n",
     "\n",
+    "def _blank(match: re.Match) -> str:\n",
+    "    \"\"\"Replace a quoted span with empty quotes and a comment with a space.\"\"\"\n",
+    "    text = match.group(0)\n",
+    "    return \" \" if text.startswith((\"/*\", \"//\")) else \"''\"\n",
+    "\n",
+    "\n",
     "def _is_session_scoped(query: str) -> bool:\n",
     "    \"\"\"Whether the query restricts itself to this session.\n",
     "\n",
@@ -210,7 +224,7 @@
     "    $sess})` still slips through. Production code puts this on the server as\n",
     "    row-level security rather than in a client regex.\n",
     "    \"\"\"\n",
-    "    bare = _QUOTED_RE.sub(\"''\", query)\n",
+    "    bare = _MASKED_RE.sub(_blank, query)\n",
     "    for where in _WHERE_RE.finditer(bare):\n",
     "        nxt = _CLAUSE_START_RE.search(bare, where.end())\n",
     "        clause = bare[where.end(): nxt.start() if nxt else len(bare)]\n",
@@ -318,11 +332,12 @@
     "### The guard, checked\n",
     "\n",
     "`query_facts` runs whatever Cypher the model writes, so the scope check is the\n",
-    "only thing keeping one session out of another's facts. Three queries below read\n",
+    "only thing keeping one session out of another's facts. Five queries below read\n",
     "every session and have to be refused: the predicate placed in `RETURN` instead\n",
-    "of `WHERE`, the same predicate hidden inside a backtick-quoted alias, and one\n",
-    "sitting in a string literal. This runs on every execution, so a loosened regex\n",
-    "fails here rather than in front of a user.\n"
+    "of `WHERE`, the same predicate hidden inside a backtick-quoted alias, one\n",
+    "sitting in a string literal, and one commented out in each of Cypher's two\n",
+    "comment forms. This runs on every execution, so a loosened regex fails here\n",
+    "rather than in front of a user.\n"
    ]
   },
   {
@@ -336,6 +351,11 @@
     "    \"MATCH (n {session: $sess}) RETURN n\",\n",
     "    \"MATCH (a)-[r]->(b {session: $sess}) RETURN a, b\",\n",
     "    \"MATCH (n) WHERE n.session = $sess RETURN n ORDER BY n.name LIMIT 5\",\n",
+    "    # A comment must not swallow the predicate next to it.\n",
+    "    \"MATCH (n) // pick this session\\n WHERE n.session = $sess RETURN n\",\n",
+    "    \"MATCH (n) WHERE n.session = $sess /* scoped */ RETURN n\",\n",
+    "    # '//' inside a string opens no comment.\n",
+    "    \"MATCH (n) WHERE n.url = 'http://x' AND n.session = $sess RETURN n\",\n",
     "]\n",
     "unscoped = [\n",
     "    \"MATCH (n) RETURN n\",\n",
@@ -347,6 +367,9 @@
     "    \"MATCH (n) RETURN n AS `WHERE n.session = $sess`\",\n",
     "    # A string literal is data; it restricts nothing.\n",
     "    \"WITH '.session = $sess' AS note MATCH (n) WHERE true RETURN n\",\n",
+    "    # The engine ignores both comment forms, so neither restricts anything.\n",
+    "    \"MATCH (n) WHERE true /* n.session = $sess */ RETURN n\",\n",
+    "    \"MATCH (n) WHERE true // n.session = $sess\\n RETURN n\",\n",
     "]\n",
     "\n",
     "wrong = [q for q in scoped if not _is_session_scoped(q)]\n",