[ahamed3620]

Description

Add extension-local regression coverage for the Database Explorer's read-only SQL contract. Shared query validation now rejects data-modifying CTE statements as well as direct writes, and both the HTTP endpoint and canvas action use the same validated query runner.

Related Issue

Closes #164

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 💥 Breaking change (fix or feature that would cause existing functionality to change)
• 📚 Documentation update
• 🧪 Test update
• 🔧 Refactor (no functional changes)

Changes Made

• Extracted the production query policy, shared runner, and HTTP server into importable modules; wired both entry points through the shared policy.
• Added typed Vitest tests using disposable in-memory SQLite fixtures to verify supported SELECT/CTE results, reject malformed/multiple/write statements before execution, and preserve fixture rows and schema.
• Verified the HTTP and canvas-action entry points return consistent accepted and rejected outcomes; added extension test discovery and TypeScript inclusion.

Testing

• npm run test:unit — passed; 5 test files, 58 tests.
• npx vitest run .github/extensions/database-explorer/query-policy.test.ts --reporter=verbose — passed; 19 Database Explorer tests.
• npm run lint — passed.
• npm run typecheck:all — passed; 37 Astro files checked with 0 errors, warnings, or hints.
• git diff --cached --check — passed.
• npm run test:e2e and npm run build were not run; this change does not modify the Astro UI or site build behavior.

The new Database Explorer query policy test cases are: accepts a select query and returns fixture rows, accepts a read-only CTE and returns fixture rows, accepts a CTE with a quoted identifier and returns fixture rows, accepts comments and quoted semicolons and returns fixture rows; rejects empty input explicitly, rejects whitespace input explicitly, rejects non-string input explicitly, rejects invalid statement explicitly, rejects multiple statements explicitly, rejects unclosed SQL string explicitly, rejects unclosed comment explicitly, rejects insert statement explicitly, rejects update statement explicitly, rejects delete statement explicitly, rejects schema statement explicitly, rejects write statement after a CTE explicitly; does not execute rejected requests, preserves fixture rows and schema while enforcing the policy against SQLite, and enforces the shared policy through HTTP and canvas actions.

Data Layer Changes

• Ran npm run test:unit - all tests pass
• Added/updated Vitest tests for data-layer changes (N/A; coverage targets the extension query contract)
• Generated a migration (npm run db:generate) for any schema change (N/A; no schema change)

Frontend Changes

• Ran npm run test:e2e - all tests pass
• Added data-testid attributes to interactive elements
• Verified build succeeds (npm run build)

Checklist

• My code follows the project's coding standards
• I have used explicit TypeScript types for function parameters and return values
• I have built the UI with Astro components and Tailwind CSS utility classes (dark theme) (N/A; no UI changes)
• I have updated documentation (README, instruction files) if needed (not needed for this test-only scope)
• My changes are focused on a single concern
• I have written clear commit messages explaining what and why

Additional Notes

All database checks use an in-memory SQLite database; tests do not access the project database, credentials, or remote databases.