fix: close oracle round 16 gaps

- Detect unresolved bind parameters in subqueries and raise CompileError
  instead of silently rendering NULL with literal_binds=True
- Handle single-quoted strings in _split_sql_list_quote_aware()
- Strip quoted literals before constraint keyword detection in
  _guard_alter_add_column_constraints() to prevent false positives

Author: yeongseon

src/sqlalchemy_excel/compiler.py

@@ -91,6 +91,10 @@ class ExcelCompiler(compiler.SQLCompiler):
     _in_in_clause: bool = False
     _subquery_depth: int = 0
     _has_join: bool = False
+    _SUBQUERY_BINDPARAM_ERROR = (
+        "Excel dialect does not support execution-time bind parameters in "
+        "subqueries. Use literal values instead."
+    )
 
     @staticmethod
     def _raise_if_schema_qualified(table: Any) -> None:
@@ -284,6 +288,44 @@ def _reject_correlated_subquery(self, inner: Any) -> None:
                     "Excel dialect does not support correlated subqueries"
                 )
 
+    def _is_unresolved_bindparam(self, bindparam: elements.BindParameter[Any]) -> bool:
+        return bool(getattr(bindparam, "required", False)) and (
+            getattr(bindparam, "callable", None) is None
+        )
+
+    def visit_bindparam(
+        self,
+        bindparam: Any,
+        within_columns_clause: Any = False,
+        literal_binds: Any = False,
+        skip_bind_expression: Any = False,
+        literal_execute: Any = False,
+        render_postcompile: Any = False,
+        is_upsert_set: Any = False,
+        **kwargs: Any,
+    ) -> str:
+        if (
+            self._subquery_depth > 0
+            and bool(literal_binds)
+            and isinstance(bindparam, elements.BindParameter)
+            and self._is_unresolved_bindparam(bindparam)
+        ):
+            raise exc.CompileError(self._SUBQUERY_BINDPARAM_ERROR)
+
+        visit_bp = cast("Callable[..., str]", super().visit_bindparam)
+        return str(
+            visit_bp(
+                bindparam,
+                within_columns_clause=within_columns_clause,
+                literal_binds=literal_binds,
+                skip_bind_expression=skip_bind_expression,
+                literal_execute=literal_execute,
+                render_postcompile=render_postcompile,
+                is_upsert_set=is_upsert_set,
+                **kwargs,
+            )
+        )
+
     def visit_function(
         self,
         func: Any,

src/sqlalchemy_excel/dialect.py

@@ -143,20 +143,22 @@ def _split_sql_list_quote_aware(sql: str) -> list[str]:
     start = 0
     depth = 0
     in_quote = False
+    quote_char = ""
     i = 0
     while i < len(sql):
         ch = sql[i]
         if in_quote:
-            if ch == '"':
-                if i + 1 < len(sql) and sql[i + 1] == '"':
+            if ch == quote_char:
+                if i + 1 < len(sql) and sql[i + 1] == quote_char:
                     i += 2
                     continue
                 in_quote = False
             i += 1
             continue
 
-        if ch == '"':
+        if ch in ("'", '"'):
             in_quote = True
+            quote_char = ch
         elif ch == "(":
             depth += 1
         elif ch == ")" and depth > 0:
@@ -195,6 +197,33 @@ def _coerce_bool_query_value(raw: Any) -> bool:
     return str(value).lower() in ("true", "1", "yes")
 
 
+def _strip_quoted_literals(sql: str) -> str:
+    out: list[str] = []
+    in_quote = False
+    quote_char = ""
+    i = 0
+    while i < len(sql):
+        ch = sql[i]
+        if in_quote:
+            if ch == quote_char:
+                if i + 1 < len(sql) and sql[i + 1] == quote_char:
+                    i += 2
+                    continue
+                in_quote = False
+            i += 1
+            continue
+
+        if ch in ("'", '"'):
+            in_quote = True
+            quote_char = ch
+            i += 1
+            continue
+
+        out.append(ch)
+        i += 1
+    return "".join(out)
+
+
 def _parse_alter_add_column(statement: str) -> tuple[str, str, str] | None:
     match = re.match(
         r'^ALTER TABLE\s+("[^"]+"|[A-Za-z_][A-Za-z0-9_]*)\s+ADD\s+COLUMN\s+("[^"]+"|[A-Za-z_][A-Za-z0-9_]*)\s+(.+?)\s*;?$',
@@ -420,7 +449,7 @@ def _guard_alter_add_column_constraints(self, cursor: Any, statement: str) -> No
             return
 
         raw_table_name, _raw_col_name, remainder = add_match
-        tail = remainder.upper()
+        tail = _strip_quoted_literals(remainder).upper()
         requires_existing_rows_backfill = "NOT NULL" in tail or "PRIMARY KEY" in tail
         if not requires_existing_rows_backfill:
             return

tests/test_alter_table.py

@@ -120,6 +120,39 @@ def test_alter_table_add_primary_key_column_to_non_empty_table_raises(engine) ->
     assert pk_columns == ["id"]
 
 
+def test_alter_table_add_column_with_primary_key_string_default_is_allowed(
+    engine,
+) -> None:
+    metadata = MetaData()
+    users = _create_users_table(metadata)
+    metadata.create_all(engine)
+
+    with engine.begin() as conn:
+        conn.execute(insert(users).values(id=1, name="Alice", age=30))
+
+    with engine.begin() as conn:
+        conn.exec_driver_sql(
+            "ALTER TABLE users ADD COLUMN note TEXT DEFAULT 'PRIMARY KEY'"
+        )
+
+    columns = {col["name"]: col for col in inspect(engine).get_columns("users")}
+    assert "note" in columns
+    # Guard should NOT reject this — 'PRIMARY KEY' is inside a string literal,
+    # not an actual constraint. We only verify the column was added successfully.
+
+
+def test_alter_table_add_column_with_actual_not_null_still_rejected(engine) -> None:
+    metadata = MetaData()
+    users = _create_users_table(metadata)
+    metadata.create_all(engine)
+
+    with engine.begin() as conn:
+        conn.execute(insert(users).values(id=1, name="Alice", age=30))
+
+    with engine.begin() as conn, pytest.raises(exc.OperationalError, match="non-empty"):
+        conn.exec_driver_sql("ALTER TABLE users ADD COLUMN note TEXT NOT NULL")
+
+
 def test_alter_table_add_column_warns_for_unsupported_unique(engine) -> None:
     ddl = AddColumn("users", Column("email", String, unique=True))
 

tests/test_compiler_guards.py

@@ -13,6 +13,7 @@
     String,
     Table,
     UniqueConstraint,
+    bindparam,
     create_engine,
     distinct,
     exc,
@@ -394,6 +395,37 @@ def test_compiler_allows_not_in_subquery(tmp_xlsx: str) -> None:
     engine.dispose()
 
 
+def test_compiler_allows_subquery_with_inline_literal_predicate(tmp_xlsx: str) -> None:
+    engine = create_engine(f"excel:///{tmp_xlsx}")
+    metadata = MetaData()
+    users, orders = _build_tables(metadata)
+
+    sub = select(orders.c.user_id).where(orders.c.user_id == 1)
+    stmt = select(users).where(users.c.id.in_(sub))
+    compiled = stmt.compile(dialect=engine.dialect)
+    sql = str(compiled)
+    assert "IN" in sql
+    assert "= 1" in sql
+
+    engine.dispose()
+
+
+def test_compiler_rejects_unresolved_bindparam_in_subquery(tmp_xlsx: str) -> None:
+    engine = create_engine(f"excel:///{tmp_xlsx}")
+    metadata = MetaData()
+    users, orders = _build_tables(metadata)
+
+    sub = select(orders.c.user_id).where(orders.c.user_id == bindparam("user_id"))
+    stmt = select(users).where(users.c.id.in_(sub))
+    with pytest.raises(
+        exc.CompileError,
+        match="execution-time bind parameters in subqueries",
+    ):
+        stmt.compile(dialect=engine.dialect)
+
+    engine.dispose()
+
+
 def test_compiler_accepts_update_with_subquery(tmp_xlsx: str) -> None:
     """UPDATE with IN subquery should compile successfully."""
     engine = create_engine(f"excel:///{tmp_xlsx}")

tests/test_ddl.py

@@ -148,6 +148,17 @@ def test_drop_table_sql(self, engine, users_table):
         assert sql == "DROP TABLE users"
 
 
+def test_split_sql_list_quote_aware_handles_single_quoted_comma() -> None:
+    """Verify _split_sql_list_quote_aware keeps commas inside single quotes."""
+    from sqlalchemy_excel.dialect import _split_sql_list_quote_aware
+
+    sql = "id INTEGER PRIMARY KEY, note TEXT DEFAULT 'a,b' NOT NULL"
+    parts = _split_sql_list_quote_aware(sql)
+    assert len(parts) == 2
+    assert parts[0].strip() == "id INTEGER PRIMARY KEY"
+    assert "DEFAULT 'a,b'" in parts[1]
+
+
 class TestDDLExecution:
     """Test DDL statement execution (integration)."""