[diegosouzapw]

Closes #3500 — Hard Rule #5 fully resolved

All 13 internal raw-SQL route offenders are now in src/lib/db/ modules (slices 1–5, merged). This final step reclassifies the gate's allowlist:

• KNOWN_RAW_SQL → EXTERNAL_DB_ALLOWED (back-compat alias kept for existing tests).
• The set now holds only the 2 external-DB reads (oauth/cursor/auto-import, oauth/kiro/auto-import) — they open another application's SQLite file (Cursor's / Kiro's) to auto-import credentials, so by design they cannot live in OmniRoute's db/ domain. Documented as an explicit external-DB exception, not debt.
• Gate behavior unchanged: any NEW raw SQL against OmniRoute's DB in a route/handler still fails.

Validation

• ✅ gate OK: 2 leituras de DB externo permitidas (#3500)
• ✅ check-db-rules.test 18/18 (alias works); #3499 classification test 5/5; lint 0 errors

Closes #3500.

[gemini-code-assist]

Code Review

This pull request fully resolves issue #3500 by migrating all remaining raw SQL queries from route handlers into dedicated database modules, satisfying Hard Rule #5. In scripts/check/check-db-rules.mjs, the KNOWN_RAW_SQL set is renamed to EXTERNAL_DB_ALLOWED to represent allowed external database reads, with a backward-compatibility alias KNOWN_RAW_SQL defined. The reviewer pointed out that neither of these constants is exported, which would cause import errors for external tests or consumers attempting to import them, and provided a suggestion to export both.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

The comment mentions that KNOWN_RAW_SQL is kept as a backward-compatibility alias for tests/consumers that import it. However, neither EXTERNAL_DB_ALLOWED nor KNOWN_RAW_SQL are currently exported from this module. If external test files or other modules attempt to import them, it will result in an import error. They should be prefixed with export to be accessible externally.

Suggested change

	const EXTERNAL_DB_ALLOWED = new Set([
	"src/app/api/oauth/cursor/auto-import/route.ts", // read-only no itemTable do SQLite do Cursor (DB externo)
	"src/app/api/oauth/kiro/auto-import/route.ts", // read-only no SQLite do Kiro (DB externo)
	]);
	// Alias de retrocompatibilidade (testes/consumidores que importam KNOWN_RAW_SQL).
	// Comportamento do gate idêntico — só o nome e o enquadramento mudaram (#3500).
	const KNOWN_RAW_SQL = EXTERNAL_DB_ALLOWED;
	export const EXTERNAL_DB_ALLOWED = new Set([
	"src/app/api/oauth/cursor/auto-import/route.ts", // read-only no itemTable do SQLite do Cursor (DB externo)
	"src/app/api/oauth/kiro/auto-import/route.ts", // read-only no SQLite do Kiro (DB externo)
	]);
	// Alias de retrocompatibilidade (testes/consumidores que importam KNOWN_RAW_SQL).
	// Comportamento do gate idêntico — só o nome e o enquadramento mudaram (#3500).
	export const KNOWN_RAW_SQL = EXTERNAL_DB_ALLOWED;