CMS-027A — Protect editorial project databases from puzzle importer

[levallem]

Summary

Hardens import_puzzles so editorial project databases cannot reach puzzle-corpus migrations.

• rejects any destination whose filename ends with .cms.sqlite;
• inspects existing SQLite destinations before migrations and rejects databases whose project_metadata.application_id matches PROJECT_APPLICATION_ID;
• keeps existing ocp.db, full-import confinement, resume, source-identity, traversal, symlink and sibling-prefix protections unchanged;
• preserves valid puzzle-corpus resume destinations.

Safety

Project-DB rejection is verified before establish_connection() -> run_migrations(MIGRATIONS) in the importer execution path.

Tests verify rejected projects keep identical bytes and table sets and do not gain puzzles, puzzle_import_progress, or favs tables.

Validation

• cargo test --locked --bin import_puzzles — 47 passed
• cargo test --locked — passed
• cargo fmt --check — passed
• cargo clippy --locked --all-targets -- -D warnings — passed
• cargo check --locked --all-targets — passed
• git diff --check — passed

Closes #60

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-04T11:39:44.740534Z	27b0931	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 27b09311b8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Reject SQLite URI destinations before validating paths

When a limited import is invoked without --resume using a destination such as --db 'file:book.cms.sqlite?mode=rw', these checks inspect the literal URI as a filesystem path: the extension check misses the query suffix, and is_file() returns false. Diesel subsequently passes the value to SQLite, which interprets it as a URI and opens the existing book.cms.sqlite, allowing the importer migrations to modify the protected project. Reject file: destinations or resolve and validate the actual SQLite target before opening it.

Useful? React with 👍 / 👎.