fix: Harden URL masking and view dependency detection

[mhiro2]

Summary

• Mask secret query parameters (e.g. password, token) in database URLs propagated through introspection
  errors, and handle postgres/postgresql and mysql/mariadb scheme aliases so rewritten URLs stay
  sanitized
• Replace substring-based view dependency detection with sqlparser AST traversal that correctly excludes CTE
  aliases and SQL comments, and supports schema-qualified relation references
• Escape control characters and brackets in Mermaid, D2, and DOT exports; generate fallback names for empty
  node labels/ids; deduplicate sanitized Mermaid column identifiers
• Emit a PARSE-4 warning when SQL input produces no tables, views, or enums without any hard errors, making
  comment-only or whitespace-only input distinguishable from a clean empty schema

Changes

• 5c24a14 : fix(introspect): mask database url secrets in propagated errors
  • Scrub secret query parameters (password, token, api_key, etc.) in addition to authority credentials
    when masking database URLs
  • Handle postgres/postgresql and mysql/mariadb scheme aliases and re-scan error messages so query
    secrets remain masked even after upstream libraries rewrite the scheme or pre-mask authority credentials
  • Funnel introspection failures through sanitized_for_url in the app layer so leaked connection strings
    are harder to emit via stderr or tracing
• aa2bee5 : fix(layout): harden diagram export names and identifiers
  • Escape control characters (\n, \r) and brackets in Mermaid, D2, and DOT output so malformed graph
    input no longer produces diagram files that downstream tooling fails to parse
  • Generate fallback export names (node_N) when graph node labels or ids are empty, and resolve edge
    endpoints through the same sanitized name table
  • Deduplicate sanitized Mermaid column identifiers per node so distinct source columns like user id,
    user-id, user_id no longer collapse into a single rendered field
• 41eb4e4 : fix(core): detect view dependencies via sql ast
  • Walk sqlparser relations through a shared SqlRelation collector instead of matching lowercase
    substrings, eliminating false edges from comments and CTE aliases
  • Support schema-qualified references (public.users vs analytics.users) and expose
    collect_sql_relations / SqlRelation from relune-core so layout and core use the same matching helpers
  • Fall back to an empty relation set with a debug log when no SQL dialect can parse a view definition
• 3137cae : fix(parser): warn when sql yields empty schema
  • Emit a PARSE-4 warning when SQL input finishes without producing any tables, views, or enums and has no
    hard errors
  • Propagate the diagnostic through schema input handling so comment-only or whitespace-only SQL no longer
    looks like a clean empty schema

[github-actions]

Code Metrics Report

	main (54e2969)	#43 (be21b27)	+/-
Coverage	93.7%	93.8%	+0.0%
Test Execution Time	1m50s	2m3s	+13s

Details

  |                     | main (54e2969) | #43 (be21b27) |  +/-  |
  |---------------------|----------------|---------------|-------|
+ | Coverage            |          93.7% |         93.8% | +0.0% |
  |   Files             |             71 |            71 |     0 |
  |   Lines             |          28751 |         29404 |  +653 |
+ |   Covered           |          26956 |         27589 |  +633 |
- | Test Execution Time |          1m50s |          2m3s |  +13s |

Code coverage of files in pull request scope (92.3% → 92.8%)

Files	Coverage	+/-	Status
crates/relune-app/src/schema_input.rs	88.8%	+1.8%	modified
crates/relune-core/src/diagnostic.rs	84.9%	+0.5%	modified
crates/relune-core/src/graph.rs	97.2%	-1.2%	modified
crates/relune-introspect/src/error.rs	95.4%	-4.6%	modified
crates/relune-introspect/src/lib.rs	90.0%	0.0%	modified
crates/relune-introspect/src/url.rs	95.6%	-4.4%	modified
crates/relune-layout/src/diagram_export.rs	93.9%	-0.4%	modified
crates/relune-layout/src/graph.rs	98.8%	+1.0%	modified
crates/relune-parser-sql/src/lib.rs	86.4%	+0.0%	modified

---

Reported by octocov