Merge pull request #139 from multinet-app/137-aql-queries

Author: jjnesbitt

multinet/api/migrations/0012_aqlquery_bind_vars.py

@@ -0,0 +1,18 @@
+# Generated by Django 3.2.12 on 2022-08-02 21:03
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('api', '0011_auto_20210927_2228'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='aqlquery',
+            name='bind_vars',
+            field=models.JSONField(blank=True, default=dict),
+        ),
+    ]

multinet/api/models/tasks.py

@@ -44,4 +44,5 @@ class AqlQuery(Task):
     """An object to track AQL queries."""
 
     query = models.TextField()
+    bind_vars = models.JSONField(blank=True, default=dict)
     results = models.JSONField(blank=True, null=True)

multinet/api/tasks/aql/aql_query.py

@@ -16,10 +16,15 @@ class AqlQueryTask(MultinetCeleryTask):
 def execute_query(task_id: int) -> None:
     query_task: AqlQuery = AqlQuery.objects.select_related('workspace').get(id=task_id)
     workspace: Workspace = query_task.workspace
-    query_str = query_task.query
+
     # Run the query on Arango DB
     database = workspace.get_arango_db()
-    query = ArangoQuery(database, query_str, time_limit_secs=60)
+    query = ArangoQuery(
+        database,
+        query_str=query_task.query,
+        bind_vars=query_task.bind_vars,
+        time_limit_secs=60,
+    )
     cursor: Cursor = query.execute()
 
     # Store the results on the task object

multinet/api/tests/test_query.py

@@ -15,26 +15,45 @@ def valid_query(workspace: Workspace, user: User, authenticated_api_client: APIC
     """Create a fixture representing the response of a POST request for AQL queries."""
     workspace.set_user_permission(user, WorkspaceRoleChoice.READER)
     node_table = populated_table(workspace, False)
-    query_str = f'FOR document IN {node_table.name} RETURN document'
+
+    query_str = 'FOR document IN @@TABLE RETURN document'
+    bind_vars = {'@TABLE': node_table.name}
     r: Response = authenticated_api_client.post(
-        f'/api/workspaces/{workspace.name}/queries/', {'query': query_str}, format='json'
+        f'/api/workspaces/{workspace.name}/queries/',
+        {'query': query_str, 'bind_vars': bind_vars},
+        format='json',
     )
     WorkspaceRole.objects.filter(workspace=workspace, user=user).delete()
-    return {'response': r, 'query': query_str, 'nodes': list(node_table.get_rows())}
+
+    return {
+        'response': r,
+        'query': query_str,
+        'bind_vars': bind_vars,
+        'nodes': list(node_table.get_rows()),
+    }
 
 
 @pytest.fixture
 def mutating_query(workspace: Workspace, user: User, authenticated_api_client: APIClient):
     """Create a fixture for a mutating AQL query that will have an error message post processing."""
     workspace.set_user_permission(user, WorkspaceRoleChoice.READER)
     node_table = populated_table(workspace, False)
-    fake = Faker()
-    query_str = f"INSERT {{ 'name': {fake.pystr()} }} INTO {node_table.name}"
+
+    query_str = 'INSERT {name: @DOCNAME} INTO @@TABLE'
+    bind_vars = {'@TABLE': node_table.name, 'DOCNAME': Faker().pystr()}
     r: Response = authenticated_api_client.post(
-        f'/api/workspaces/{workspace.name}/queries/', {'query': query_str}, format='json'
+        f'/api/workspaces/{workspace.name}/queries/',
+        {'query': query_str, 'bind_vars': bind_vars},
+        format='json',
     )
     WorkspaceRole.objects.filter(workspace=workspace, user=user).delete()
-    return {'response': r, 'query': query_str, 'nodes': list(node_table.get_rows())}
+
+    return {
+        'response': r,
+        'query': query_str,
+        'bind_vars': bind_vars,
+        'nodes': list(node_table.get_rows()),
+    }
 
 
 @pytest.mark.django_db
@@ -45,6 +64,7 @@ def test_query_rest_create(workspace: Workspace, user: User, valid_query):
         'id': INTEGER_ID_RE,
         'workspace': workspace_re(workspace),
         'query': valid_query['query'],
+        'bind_vars': valid_query['bind_vars'],
         'user': user.username,
         'error_messages': None,
         'status': AqlQuery.Status.PENDING,
@@ -63,6 +83,7 @@ def test_query_rest_create_mutating(workspace: Workspace, user: User, mutating_q
         'id': INTEGER_ID_RE,
         'workspace': workspace_re(workspace),
         'query': mutating_query['query'],
+        'bind_vars': mutating_query['bind_vars'],
         'user': user.username,
         'error_messages': None,
         'status': AqlQuery.Status.PENDING,

multinet/api/tests/test_workspace.py

@@ -447,10 +447,16 @@ def test_workspace_rest_aql(
     node_table = populated_table(workspace, False)
     nodes: Cursor = node_table.get_rows()
     nodes_list = list(nodes)
+
     # try and execute a valid non-mutating query on the data
-    query = f'FOR document IN {node_table.name} RETURN document'
-    r = authenticated_api_client.get(
-        f'/api/workspaces/{workspace.name}/aql/', data={'query': query}
+    r = authenticated_api_client.post(
+        f'/api/workspaces/{workspace.name}/aql/',
+        {
+            'query': 'FOR doc IN @@TABLE RETURN doc',
+            'bind_vars': {
+                '@TABLE': node_table.name,
+            },
+        },
     )
     assert r.status_code == status_code
 
@@ -466,11 +472,17 @@ def test_workspace_rest_aql_mutating_query(
 ):
     workspace.set_user_permission(user, WorkspaceRoleChoice.READER)
     fake = Faker()
-
     node_table = populated_table(workspace, False)
+
     # Mutating query
-    query = f"INSERT {{ 'name': {fake.pystr()} }} INTO {node_table.name}"
-    r = authenticated_api_client.get(
-        f'/api/workspaces/{workspace.name}/aql/', data={'query': query}
+    r = authenticated_api_client.post(
+        f'/api/workspaces/{workspace.name}/aql/',
+        data={
+            'query': 'INSERT {name: @DOCNAME} INTO @@TABLE',
+            'bind_vars': {
+                '@TABLE': node_table.name,
+                'DOCNAME': fake.pystr(),
+            },
+        },
     )
     assert r.status_code == 400

multinet/api/views/query.py

@@ -29,14 +29,14 @@ def create(self, request, parent_lookup_workspace__name: str):
         workspace: Workspace = get_object_or_404(Workspace, name=parent_lookup_workspace__name)
         serializer = AqlQuerySerializer(data=request.data)
         serializer.is_valid(raise_exception=True)
-        query_str = serializer.validated_data['query']
-
         query: AqlQuery = AqlQuery.objects.create(
-            workspace=workspace, user=request.user, query=query_str
+            workspace=workspace,
+            user=request.user,
+            query=serializer.validated_data['query'],
+            bind_vars=serializer.validated_data['bind_vars'],
         )
 
         execute_query.delay(task_id=query.pk)
-
         return Response(AqlQueryTaskSerializer(query).data, status=status.HTTP_200_OK)
 
     @swagger_auto_schema(responses={200: AqlQueryResultsSerializer()})

multinet/api/views/serializers.py

@@ -89,6 +89,7 @@ class SingleUserWorkspacePermissionSerializer(serializers.Serializer):
 
 class AqlQuerySerializer(serializers.Serializer):
     query = serializers.CharField()
+    bind_vars = serializers.DictField(child=serializers.CharField())
 
 
 class AqlQueryTaskSerializer(serializers.ModelSerializer):

multinet/api/views/workspace.py

@@ -178,17 +178,22 @@ def put_workspace_permissions(self, request, name: str):
 
         return Response(PermissionsReturnSerializer(workspace).data, status=status.HTTP_200_OK)
 
-    @swagger_auto_schema(query_serializer=AqlQuerySerializer())
-    @action(detail=True)
+    @swagger_auto_schema(request_body=AqlQuerySerializer())
+    @action(detail=True, methods=['POST'])
     @require_workspace_permission(WorkspaceRoleChoice.READER)
     def aql(self, request, name: str):
         """Execute AQL in a workspace."""
-        serializer = AqlQuerySerializer(data=request.query_params)
+        serializer = AqlQuerySerializer(data=request.data)
         serializer.is_valid(raise_exception=True)
-        query_str = serializer.validated_data['query']
+
+        # Retrieve workspace and db
         workspace: Workspace = get_object_or_404(Workspace, name=name)
         database = workspace.get_arango_db()
-        query = ArangoQuery(database, query_str)
+
+        # Form query
+        query_str = serializer.validated_data['query']
+        bind_vars = serializer.validated_data['bind_vars']
+        query = ArangoQuery(database, query_str=query_str, bind_vars=bind_vars)
 
         try:
             cursor: Cursor = query.execute()

tox.ini

@@ -8,7 +8,7 @@ envlist =
 skipsdist = true
 skip_install = true
 deps =
-    flake8
+    flake8 < 5
     flake8-black
     flake8-bugbear
     flake8-docstrings