fix(security): close backend merge blockers

app/native/wndb/database.py

@@ -1,3 +1,4 @@
+from collections.abc import Mapping, Sequence
 from typing import Any
 from psycopg.rows import dict_row, Row
 from .connection import project_connection
@@ -82,27 +83,38 @@ class DbChangeSet:
         return DbChangeSet(redo_sql, undo_sql, redo_cs_s, undo_cs_s)
 
 
-def read(name: str, sql: str) -> Row:
+QueryParams = Sequence[Any] | Mapping[str, Any]
+
+
+def _execute(cur, sql: str, params: QueryParams | None = None):
+    return cur.execute(sql, params) if params is not None else cur.execute(sql)
+
+
+def read(name: str, sql: str, params: QueryParams | None = None) -> Row:
     with project_connection(name) as conn:
         with conn.cursor(row_factory=dict_row) as cur:
-            cur.execute(sql)
+            _execute(cur, sql, params)
             row = cur.fetchone()
             if row == None:
                 raise Exception(sql)
             return row
 
 
-def read_all(name: str, sql: str) -> list[Row]:
+def read_all(
+    name: str, sql: str, params: QueryParams | None = None
+) -> list[Row]:
     with project_connection(name) as conn:
         with conn.cursor(row_factory=dict_row) as cur:
-            cur.execute(sql)
+            _execute(cur, sql, params)
             return cur.fetchall()
 
 
-def try_read(name: str, sql: str) -> Row | None:
+def try_read(
+    name: str, sql: str, params: QueryParams | None = None
+) -> Row | None:
     with project_connection(name) as conn:
         with conn.cursor(row_factory=dict_row) as cur:
-            cur.execute(sql)
+            _execute(cur, sql, params)
             return cur.fetchone()