fix(python): compose Postgres filters as SQL

[tgolob]

Summary

• Compose PostgresCollection filter fragments as psycopg.sql.SQL instead of passing pre-built predicates as plain strings that psycopg quotes as values.
• Preserve the separator between the table name and WHERE when a filter is present.
• Add regression coverage for both a single lambda filter and multiple filters.

Fixes #14311

Validation

• python -m pytest python/tests/unit/connectors/memory/test_postgres_store.py -q (22 passed)
• ruff check --config python/pyproject.toml python/semantic_kernel/connectors/postgres.py (passed)
• ruff format --config python/pyproject.toml --check python/semantic_kernel/connectors/postgres.py python/tests/unit/connectors/memory/test_postgres_store.py (passed)
• python -m compileall -q python/semantic_kernel/connectors/postgres.py python/tests/unit/connectors/memory/test_postgres_store.py (passed)

The regression is verified offline by rendering the psycopg query; no live PostgreSQL service is required.

[tgolob]

Reviewer doubt: this patch wraps the _lambda_parser output in psycopg.sql.SQL(...) and relies on the parser's field allowlist and literal escaping for safety. Please confirm that this remains the preferred security boundary, or whether maintainers want bound parameters introduced as a follow-up instead.

[Copilot]

Pull request overview

This PR fixes PostgresCollection vector-search filter handling by ensuring filter predicates are composed as SQL fragments (instead of being treated as quoted literal values by psycopg.sql.SQL.format()), and adds a regression test to prevent the malformed WHERE '<predicate>' behavior.

Changes:

• Compose _build_filter(...) output into psycopg.sql.SQL objects before formatting into the final query.
• Ensure the query includes a separating space before WHERE when filters are present (... FROM schema.table WHERE ...).
• Add unit regression coverage for both single-filter and multi-filter cases.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
python/semantic_kernel/connectors/postgres.py	Builds WHERE by wrapping filter fragments with sql.SQL(...) and adds correct spacing before WHERE.
python/tests/unit/connectors/memory/test_postgres_store.py	Adds regression test asserting filter predicates render as SQL (not quoted string literals) for single and multiple filters.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MAF Automated Review — Iteration 1

Result: No findings
Scope: full PR (1 commit(s)): 5f610b91f8c0
Model: claude-opus-4.8

Overview

This PR fixes issue #14311 by composing PostgresCollection filter fragments with psycopg.sql.SQL(...) instead of letting .format() quote the pre-built predicate as a value literal, and it restores the missing separator between the table name and WHERE. The fix is correct and tightly scoped to a single call site (_construct_vector_query), the filter fragments it wraps are produced solely by the trusted _lambda_parser (identifiers allowlisted to storage_names, string constants single-quote-escaped), so no new raw-text-to-SQL path is introduced. The added parametrized regression test is a genuine guard: it exercises both the single-string and list branches and fails against the pre-fix code. No Critical/High/Medium defect is attributable to the changed lines.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.

[tgolob]

@microsoft-github-policy-service agree