fix: reject foreign-table Column keys in UPSERT SET + add missing tests

- Reject Column objects from non-target tables in ON CONFLICT DO UPDATE
  SET fallback branch with CompileError (prevents silent retargeting)
- Add test_index_where_rejected_do_update (symmetric with do_nothing test)
- Add test_foreign_table_column_key_rejected (compile-time guard)

Author: yeongseon

src/sqlalchemy_excel/compiler.py

@@ -965,17 +965,25 @@ def visit_on_conflict_do_update(self, on_conflict: Any, **kw: Any) -> str:
         if set_parameters:
             from sqlalchemy import util as sa_util
 
-            table_name = getattr(
-                getattr(self.current_executable, "table", None),
-                "name",
-                "<unknown>",
-            )
+            insert_table = getattr(self.current_executable, "table", None)
+            insert_table_name = getattr(insert_table, "name", "<unknown>")
+
+            # Reject foreign-table Column keys that would silently
+            # retarget the assignment to the INSERT table
+            for k in list(set_parameters):
+                if hasattr(k, "table") and hasattr(k.table, "name"):
+                    if k.table.name != insert_table_name:
+                        raise exc.CompileError(
+                            "Column '%s' from table '%s' cannot be used as "
+                            "an ON CONFLICT DO UPDATE SET target for table '%s'"
+                            % (k.key, k.table.name, insert_table_name)
+                        )
 
             sa_util.warn(
                 "Additional column names not matching "
                 "any column keys in table '%s': %s"
                 % (
-                    table_name,
+                    insert_table_name,
                     (", ".join("'%s'" % c for c in set_parameters)),
                 )
             )

tests/test_upsert.py

@@ -256,3 +256,29 @@ def test_missing_index_elements_do_update(items_table):
 
     with pytest.raises(ValueError, match="requires index_elements"):
         stmt.on_conflict_do_update(set_={"age": 1})
+
+
+def test_index_where_rejected_do_update(items_table):
+    """index_where must be rejected on do_update too, not just do_nothing."""
+    stmt = insert(items_table).values(id=1, name="Alice", age=30, code="A")
+
+    with pytest.raises(ValueError, match="does not support index_where"):
+        stmt.on_conflict_do_update(
+            index_elements=["id"],
+            set_={"age": 1},
+            index_where=items_table.c.id > 0,
+        )
+
+
+def test_foreign_table_column_key_rejected(items_table, composite_items_table):
+    """set_ keys from a different table must be rejected at compile time."""
+    stmt = insert(items_table).values(id=1, name="Alice", age=30, code="A")
+    upsert = stmt.on_conflict_do_update(
+        index_elements=["id"],
+        set_={composite_items_table.c.age: 99},
+    )
+    from sqlalchemy.exc import CompileError
+    from sqlalchemy_excel.dialect import ExcelDialect
+
+    with pytest.raises(CompileError, match="cannot be used as an ON CONFLICT"):
+        upsert.compile(dialect=ExcelDialect())