fix(sdk): reject scalar str/bytes for get_many ids and attributes

`{"InfraDevice": {"ids": "dev-1"}}` and
`{"InfraDevice": {"ids": ["dev-1"], "attributes": "name"}}` are easy
mistakes — a caller with one id or one attribute reaches for the bare
value rather than wrapping it in a list. Strings and bytes are
iterable in Python, so the compiler used to walk them
character-by-character: the first form sent seven one-character
GraphQL ids, and the second built a selection set of
`n { value } a { value } m { value } e { value }` because each
character passed the GraphQL-identifier regex.

Reject `str`/`bytes` explicitly for both fields and surface a
descriptive `ValidationError` instead. The original list-of-id /
list-of-attribute path is unchanged.

Reported by the cubic AI code reviewer on #1108.

Author: iddocohen

infrahub_sdk/client.py

@@ -203,10 +203,18 @@ def compile_get_many_query(
             problems.append(f"{kind}: entry must be a mapping with an 'ids' key")
             continue
         ids = entry.get("ids")
-        if not ids:
-            problems.append(f"{kind}: 'ids' must be a non-empty list")
+        if not ids or isinstance(ids, (str, bytes)):
+            # A bare string passed for ``ids`` would iterate character-by-character
+            # below and turn one id into N one-character GraphQL ids — silently
+            # wrong. Reject up front.
+            problems.append(f"{kind}: 'ids' must be a non-empty list of id strings")
             continue
         attributes = entry.get("attributes") or []
+        if isinstance(attributes, (str, bytes)):
+            # Same trap as ``ids``: a bare string would split into single-char
+            # field names that each pass the identifier regex.
+            problems.append(f"{kind}: 'attributes' must be a list of attribute names")
+            continue
         bad_attrs = [a for a in attributes if not isinstance(a, str) or not _GRAPHQL_IDENTIFIER_RE.match(a)]
         if bad_attrs:
             problems.append(f"{kind}: invalid attribute names {bad_attrs!r}")

tests/unit/sdk/test_get_many.py

@@ -121,6 +121,30 @@ def test_invalid_attribute_name_raises() -> None:
         compile_get_many_query({"InfraDevice": {"ids": ["dev-1"], "attributes": ["name", "bad name"]}})
 
 
+def test_string_ids_rejected_not_iterated_as_chars() -> None:
+    # Passing a bare string would silently iterate character-by-character and
+    # send N one-character GraphQL ids. Reject up front.
+    with pytest.raises(ValidationError, match="'ids' must be a non-empty list"):
+        compile_get_many_query({"InfraDevice": {"ids": "dev-1"}})  # type: ignore[dict-item]
+
+
+def test_bytes_ids_rejected() -> None:
+    with pytest.raises(ValidationError, match="'ids' must be a non-empty list"):
+        compile_get_many_query({"InfraDevice": {"ids": b"dev-1"}})  # type: ignore[dict-item]
+
+
+def test_string_attributes_rejected_not_iterated_as_chars() -> None:
+    # Same trap as ``ids``: a bare string would split into single-character
+    # field names that each pass the GraphQL identifier regex.
+    with pytest.raises(ValidationError, match="'attributes' must be a list"):
+        compile_get_many_query({"InfraDevice": {"ids": ["dev-1"], "attributes": "name"}})  # type: ignore[dict-item]
+
+
+def test_bytes_attributes_rejected() -> None:
+    with pytest.raises(ValidationError, match="'attributes' must be a list"):
+        compile_get_many_query({"InfraDevice": {"ids": ["dev-1"], "attributes": b"name"}})  # type: ignore[dict-item]
+
+
 def test_multiple_problems_are_collected() -> None:
     with pytest.raises(ValidationError) as excinfo:
         compile_get_many_query(