pavansai1997 commented on code in PR #76230:
URL: https://github.com/apache/airflow/pull/76230#discussion_r4438891094
##########
providers/common/ai/docs/operators/llm_sql.rst:
##########
@@ -178,6 +178,38 @@ By default, the operator validates generated SQL using an
allowlist approach:
You can disable validation with ``validate_sql=False`` or customize the allowed
statement types with ``allowed_sql_types``.
+Restricting the tables a query may reference
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+``table_names`` only selects the schemas shown to the LLM; it does not stop the
+generated SQL from reading other tables. Set ``allowed_tables`` to reject any
query
+that references a table outside the list:
+
+.. code-block:: python
+
+ LLMSQLQueryOperator(
+ task_id="generate_sql",
+ prompt="Total order value per customer last month",
+ llm_conn_id="pydanticai_default",
+ db_conn_id="postgres_default",
+ table_names=["orders"],
+ allowed_tables=["orders"],
+ )
+
+Every table the query reaches is checked, including tables in subqueries and
joins,
+while a CTE defined in the query is not mistaken for a table. Constructs that
cannot
+be checked against the list, such as table-valued functions like ``dblink``,
are
+rejected too. The rules match ``SQLToolset(allowed_tables=...)``: entries are
Review Comment:
Agreed, reworded. The docs now list comments, quoted identifiers and
unrecognized functions (pointing at `allowed_functions`) as the refusals users
will hit, and say the matching is the same as `SQLToolset` except that
`SQLToolset` resolves unqualified entries through `schema`.
##########
providers/common/ai/src/airflow/providers/common/ai/operators/llm_sql.py:
##########
@@ -172,7 +196,7 @@ def execute(self, context: Context) -> str:
sql = self._strip_llm_output(result.output,
dialect=self._resolved_dialect)
if self.validate_sql:
- _validate_sql(sql, allowed_types=self.allowed_sql_types,
dialect=self._resolved_dialect)
+ self._check_sql(sql)
Review Comment:
Done both. With `allowed_tables` set, the prompt lists the tables and asks
for unquoted table names and no comments, and the check runs as an output
validator that raises `ModelRetry`, so `output_retries` covers it. The post-run
check stays as a backstop and the reviewer path still raises `SQLSafetyError`.
`test_refused_sql_is_sent_back_to_the_model` drives a real `Agent` with a
`FunctionModel` through a refusal and a successful retry.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
