src/pyseekdb/client/client_base.py:1185

• This SQL statement is vulnerable to SQL injection. The name parameter is directly interpolated into the SQL string without proper escaping or parameterization.

tests/integration_tests/test_fulltext_parser_config.py (1)

49-52: Consider extracting a helper for v1/v2 table name resolution.

Same conditional appears in three methods; a small helper would reduce duplication and keep naming logic consistent.

Also applies to: 131-134, 180-183

tests/unit_tests/test_embedding_function_registry.py (1)

95-104: Silence unused-parameter lint in stub embedding functions.

Several stubs ignore input/config, which typically triggers unused-arg lint. Consider prefixing with _ (or adding a noqa) across these stubs.

♻️ Suggested tweak (apply similarly to other stubs)

-            def __call__(self, input: Documents) -> Embeddings:
+            def __call__(self, _input: Documents) -> Embeddings:
                 return [[0.1, 0.2, 0.3]]

-            def build_from_config(config: Dict[str, Any]) -> "InvalidEmbeddingFunction":
+            def build_from_config(_config: Dict[str, Any]) -> "InvalidEmbeddingFunction":
                 return InvalidEmbeddingFunction()

src/pyseekdb/client/embedding_function.py (1)

731-736: Validate get_config during registry registration.

Docs require get_config, but register only checks name/build_from_config. Adding the check fails fast for non‑persistable classes and aligns with the contract.

♻️ Suggested fix

-        if (not hasattr(embedding_function_class, "name")
-            or not hasattr(embedding_function_class, "build_from_config")):
+        if (not hasattr(embedding_function_class, "name")
+            or not hasattr(embedding_function_class, "build_from_config")
+            or not hasattr(embedding_function_class, "get_config")):

tests/integration_tests/test_collection_embedding_function.py (1)

407-442: Ensure embedding-function registration is idempotent across parametrized runs.
These decorators execute on every parametrized run. If the registry rejects duplicate names, this can flake. Consider registering once at module scope or guarding registration with a registry lookup/try-if-absent.

Also applies to: 589-618, 675-724

tests/integration_tests/test_collection_v1_compatibility.py (1)

428-431: Drop unused collection assignment
This variable is unused and triggers Ruff F841.

🧹 Suggested fix

-        collection = db_client.create_collection(
+        db_client.create_collection(
             name=collection_name,
             _collection_version=1,
         )

src/pyseekdb/client/client_base.py (2)

756-767: Escape collection_name/settings_str in v2 metadata SQL (and fix undefined e)
Unescaped values allow SQL injection and break JSON quoting. Line 766 also references undefined e. Apply escaping (or parameterization) here and in the other v2 SQL statements listed.

🛠️ Suggested fix (core pattern)

-            settings_str = json.dumps(settings)
+            settings_str = json.dumps(settings, ensure_ascii=False)
+            collection_name_escaped = escape_string(collection_name)
+            settings_str_escaped = escape_string(settings_str)
@@
-            delete_sql = f"DELETE FROM {CollectionNames.sdk_collections_table_name()} WHERE COLLECTION_NAME = '{collection_name}'"
+            delete_sql = f"DELETE FROM {CollectionNames.sdk_collections_table_name()} WHERE COLLECTION_NAME = '{collection_name_escaped}'"
             self._execute(delete_sql)
-            insert_sql = f"INSERT INTO {CollectionNames.sdk_collections_table_name()} (COLLECTION_NAME, SETTINGS) VALUES ('{collection_name}', '{settings_str}')"
+            insert_sql = f"INSERT INTO {CollectionNames.sdk_collections_table_name()} (COLLECTION_NAME, SETTINGS) VALUES ('{collection_name_escaped}', '{settings_str_escaped}')"
             self._execute(insert_sql)
-            query_sql = f"SELECT COLLECTION_ID FROM {CollectionNames.sdk_collections_table_name()} WHERE COLLECTION_NAME = '{collection_name}'"
+            query_sql = f"SELECT COLLECTION_ID FROM {CollectionNames.sdk_collections_table_name()} WHERE COLLECTION_NAME = '{collection_name_escaped}'"
             rows = self._execute(query_sql)
-            if not rows or len(rows) == 0:
-                raise ValueError(f"Failed to create collection metadata: {e}")
+            if not rows:
+                raise ValueError("Failed to create collection metadata: no COLLECTION_ID returned")

Also applies to: 948-949, 1042-1043, 1204-1205

---

928-940: Persisted None embedding functions should not be replaced by default
When no persistence exists and the caller doesn’t pass an embedding function, this returns DefaultEmbeddingFunction, which can silently change behavior and cause dimension mismatches for collections created with embedding_function=None.

🛠️ Suggested fix

-        if embedding_function is _NOT_PROVIDED:
-            return (
-                embedding_function_persistence
-                if embedding_function_persistence is not None
-                else get_default_embedding_function()
-            )
-        else:
-            return embedding_function
+        if embedding_function is _NOT_PROVIDED:
+            return embedding_function_persistence
+        return embedding_function

tests/integration_tests/test_collection_embedding_function.py (2)

641-645: Remove unused collection assignments in tests
created_collection, coll1, and coll2 are assigned but unused (Ruff F841). Drop the assignment or use _.

🧹 Example fix (apply similarly)

-        created_collection = db_client.create_collection(
+        db_client.create_collection(
             name=collection_name,
             configuration=config,
             embedding_function=custom_ef,
         )

Also applies to: 746-758, 844-848

---

13-18: Exercise the “unregistered embedding function” error path
The test registers the class and then retrieves successfully, so it never validates the failure case described in the docstring. Remove the registry entry before get_collection() and assert the error.

🛠️ Suggested fix

-from pyseekdb.client.embedding_function import (
+from pyseekdb.client.embedding_function import (
     EmbeddingFunction,
     Documents,
     Embeddings,
     register_embedding_function,
+    EmbeddingFunctionRegistry,
 )
@@
-            # Actually, since we registered it, getting should work
-            retrieved_collection = db_client.get_collection(name=collection_name)
-            assert retrieved_collection.embedding_function is not None
+            # Remove from registry to simulate "unregistered" at restore time
+            EmbeddingFunctionRegistry._registry.pop("unregistered_embedding", None)
+
+            with pytest.raises(ValueError, match="not found"):
+                db_client.get_collection(name=collection_name)

Also applies to: 838-856

src/pyseekdb/client/embedding_function.py (1)

15-26: Annotate registry state as ClassVar
This is class-level shared state; adding ClassVar avoids Ruff RUF012 and clarifies intent.

♻️ Suggested fix

-from typing import (
+from typing import (
     List,
     Protocol,
     Union,
     runtime_checkable,
     Optional,
     TypeVar,
     cast,
     Any,
     Dict,
     Type,
+    ClassVar,
 )
@@
-    _registry: Dict[str, type] = {}
-    _initialized: bool = False
+    _registry: ClassVar[Dict[str, type]] = {}
+    _initialized: ClassVar[bool] = False

Also applies to: 663-664

src/pyseekdb/client/client_base.py (3)

931-945: Preserve persisted “no embedding function” instead of defaulting.

If a collection was created with embedding_function=None, there’s no persisted EF and _validate_embedding_function() currently substitutes DefaultEmbeddingFunction, which can cause dimension mismatches and unexpected embedding behavior.

🛠️ Suggested fix

-        if embedding_function is _NOT_PROVIDED:
-            return (
-                embedding_function_persistence
-                if embedding_function_persistence is not None
-                else get_default_embedding_function()
-            )
-        else:
-            return embedding_function
+        if embedding_function is _NOT_PROVIDED:
+            return embedding_function_persistence
+        return embedding_function

---

1045-1047: Escape collection name in _delete_collection_v2 to prevent SQL injection.

collection_name is user input and is interpolated directly into SQL.

🔒 Suggested fix

-        query_sql = f"DELETE FROM `{CollectionNames.sdk_collections_table_name()}` WHERE COLLECTION_NAME = '{name}'"
+        name_escaped = escape_string(name)
+        query_sql = (
+            f"DELETE FROM `{CollectionNames.sdk_collections_table_name()}` "
+            f"WHERE COLLECTION_NAME = '{name_escaped}'"
+        )

---

1208-1209: Escape collection name in _has_collection_v2 queries.

This query uses raw user input; it should be escaped or parameterized.

🔒 Suggested fix

-            query_sql = f"SELECT COLLECTION_ID FROM {CollectionNames.sdk_collections_table_name()} WHERE COLLECTION_NAME = '{name}'"
+            name_escaped = escape_string(name)
+            query_sql = (
+                f"SELECT COLLECTION_ID FROM {CollectionNames.sdk_collections_table_name()} "
+                f"WHERE COLLECTION_NAME = '{name_escaped}'"
+            )

src/pyseekdb/client/embedding_function.py (1)

663-665: Annotate registry class attributes with ClassVar.

These are class-level singletons; annotating them as ClassVar improves typing clarity and matches Ruff’s guidance.

♻️ Suggested refactor

-from typing import (
+from typing import (
     List,
     Protocol,
     Union,
     runtime_checkable,
     Optional,
     TypeVar,
     cast,
     Any,
     Dict,
     Type,
+    ClassVar,
 )
@@
-    _registry: Dict[str, type] = {}
-    _initialized: bool = False
+    _registry: ClassVar[Dict[str, type]] = {}
+    _initialized: ClassVar[bool] = False

tests/integration_tests/test_collection_embedding_function.py (1)

429-466: Reset the embedding-function registry between parametrized runs.
These test-scoped classes register fixed name() values and can collide across parametrized db_client runs.

♻️ Suggested fix

 class TestCollectionEmbeddingFunction:
     """Test collection creation with embedding function handling using parameterized db_client fixture"""
+    def setup_method(self):
+        EmbeddingFunctionRegistry._registry.clear()
+        EmbeddingFunctionRegistry._initialized = False