A4IHackathon - Guardians Of Data : Security hardening, column masking & injection detection, REST/Swagger integration, validated bug fixes, and full docs/onboarding

[nakultripathi-lab]

Security hardening, column masking & injection detection, REST/Swagger integration, validated bug fixes, and full docs/onboarding

Summary

This MR delivers a major round of work on sql-data-guard: five new security
capabilities, a backlog of validated security/config bug fixes, a REST API with
Swagger, an extensive unit-test suite, and complete technical + onboarding
documentation.

Net change: +5,644 / −172 across 45 files (24 commits).

New security features

• Feature 1 — Malicious-payload / SQL-injection detection (src/sql_data_guard/injection_detection.py):
  pre-parse raw-string scan (catches --, /* */, # comment-evasion) plus an
  AST scan for stacked statements, dangerous functions, and system-catalog
  probing, with intent-revealing messages and risk weights. Makes good on the
  README's long-standing "built-in detection module" claim that previously had
  no implementation.
• Feature 2 — Column-level masking (src/sql_data_guard/column_masking.py): per-table
  column_masks rewrite sensitive columns instead of dropping them — redact,
  hash (MD5), and partial (show last N) policies, preserving result shape.
• Feature 3 — Function allow-list / deny-list (_verify_functions): config-driven
  function policy on top of F1's always-on deny-list, so deployments can
  permit/forbid specific functions (e.g. block LOAD_FILE).
• Feature 4 — Mandatory LIMIT / max-rows enforcement (_enforce_force_limit):
  injects or clamps LIMIT on the outermost query via the existing auto-fix
  path, closing the full-table-exfiltration gap.
• Feature 5 — Deny-list columns & deny-aware wildcards: per-table denied_columns
  with deny-wins precedence and SELECT * / table.* expansion that never
  leaks a denied column.

Validated bug fixes (regression-tested)

Security

• S1 — escape generated restriction values via sqlglot literals; quote IN members.
• S2 — numeric (not string) comparison for < > <= >=; inject the correct operator.
• S3 — close column allow-list bypass when all FROM tables are dynamic.
• S4 — verify EXCEPT/INTERSECT (dispatch on SetOperation), not just UNION.
• S7 — explicitly reject stacked / multi-statement SQL.

Config validation (no more caller-facing HTTP 500s)

• C1 — IN accepts a non-empty list of consistently-typed values.
• C2 — require a value for =, >, <, <=, >=.
• C3 — case-insensitive operations.
• C4 — verify_sql returns a result dict on invalid config (also catches ValueError).

Reliability

• Q1 — errors returned as an ordered, de-duplicated list.

REST API & integration

• Swagger/OpenAPI integration and REST endpoint additions in
  src/sql_data_guard/rest/sql_data_guard_rest.py.
• MCP wrapper updates (src/sql_data_guard/mcpwrapper/mcp_wrapper.py).
• Dockerfile and dependency updates (pyproject.toml, requirements.txt).

Tests

New unit suites covering:

• test/test_injection_detection_unit.py
• test/test_column_masking_unit.py
• test/test_denied_columns_unit.py
• test/test_function_policy_unit.py
• test/test_limit_enforcement_unit.py
• test/test_rest_api_unit.py
• test/test_security_fixes_unit.py (validated security-fix backlog, ~395 lines)

Documentation & onboarding

• Full technical docs set (docs/technical-documentation/): index, code
  explanation, HLD, LLD, architecture, coding guidelines.
• New ONBOARDING.md and a comprehensive README.md rewrite.
• AI-assisted dev tooling: .agents/skills, .clinerules/Security-Rule.md, and
  a technical-documentation workflow.