fix(query): allow empty ARG when a filter option is provided

[ocervell]

When -rf, -ws, or -d is given without a query expression, secator q now returns all matching results instead of raising "Missing argument ARG". Bare secator q (no args, no options) still shows the error.

Fixes #1210

Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes

  • The query command no longer requires a search expression when report filters, workspace, or time range options are specified.

• Tests

  • Added unit tests to verify query command behavior with various filter combinations and arguments.

[ocervell]

@claude no need to check for -rf or even -ws:

The following should all work:

secator q                           # whole current workspace query
secator q -rf "scans/23"    # whole scans/23 in current workspace query
secator q -ws test             # whole 'test' workspace query

[coderabbitai]

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 79fa044a-835a-40f9-8716-5d8401d2cb29

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Walkthrough

The query CLI command in cli.py gains a new conditional branch: when the positional ARG is absent but at least one of report_filter, workspace, or time_delta is provided, it calls run_report_show(query=None, ...) and returns instead of raising a usage error. Three unit tests are added to cover this behavior.

Empty-ARG fallback in secator query

Layer / File(s)	Summary
Empty-ARG fallback logic and unit tests secator/cli.py, tests/unit/test_query_cli.py	cli.py adds a guard that routes to run_report_show(query=None, ...) when any filter flag is set but ARG is missing; three new TestQueryDispatch tests assert exit code 0 for -rf/-ws cases and a non-zero exit code when no args are passed at all.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

• freelabz/secator#1059: Adds backend e2e coverage for r show query translation and empty/no-query behavior that this PR's new query=None fallback path enables.
• freelabz/secator#1139: Introduces/refactors the secator query command and its shared run_report_show(...) logic that this PR extends with the empty-ARG fallback.

Suggested labels

query, cli

🐇 No ARG? No fuss!
If a filter is there,
The query hops through
with None in the air.
Results still appear —
the rabbit is pleased! 🥕

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: allowing empty ARG in the query command when filter options are provided.
Linked Issues check	✅ Passed	The PR implementation directly addresses issue #1210 by allowing empty query arguments when filter options like -rf or -ws are provided, matching the stated objective.
Out of Scope Changes check	✅ Passed	All changes are scoped to the query command functionality and related unit tests, directly addressing the linked issue requirements with no extraneous modifications.
Docstring Coverage	✅ Passed	Docstring coverage is 80.00% which is sufficient. The required threshold is 80.00%.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/issue-1210-20260623-1323

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[claude]

Claude finished @ocervell's task in 2m 32s —— View job

---

Todo

• Read and understand current implementation
• Update secator/cli.py to allow bare secator q (remove the filter guard)
• Update tests in test_query_cli.py — replace the "no filter shows error" test with "no filter shows all results"
• Commit and push changes

Changes made

secator/cli.py — removed the if report_filter or workspace or time_delta: guard. Now any bare secator q (with or without filter options) just calls run_report_show directly:

# Before
if not arg:
    if report_filter or workspace or time_delta:
        run_report_show(...)
        return
    raise click.UsageError('Missing argument ARG ...')

# After
if not arg:
    run_report_show(report_filter, output, time_delta, None, fmt, workspace, driver, dedupe, limit, output_folder)
    return

All three forms now work:

• secator q → whole current workspace query
• secator q -rf "scans/23" → scoped to that report path
• secator q -ws test → scoped to the test workspace

tests/unit/test_query_cli.py — replaced test_empty_arg_no_filter_shows_error (which expected a non-zero exit code) with test_empty_arg_no_filter_shows_all (which verifies bare secator q --driver local succeeds and returns all results).
|

[coderabbitai]

🧹 Nitpick comments (1)

tests/unit/test_query_cli.py (1)

130-149: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add one test for the time_delta-only empty-ARG path.

The new dispatch condition allows empty ARG when time_delta is set, but this branch is not covered by the added tests. A single query -d ... --driver local case would complete coverage for the new condition.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/unit/test_query_cli.py` around lines 130 - 149, Add a new test method
to cover the time_delta-only empty-ARG path. Create a test similar to
test_empty_arg_with_report_filter and test_empty_arg_with_workspace that invokes
the query command with the time_delta flag (using -d parameter) and --driver
local but no ARG value, then verify the results are returned successfully by
asserting the exit code is 0, no exception occurred, and the expected
vulnerability results are present.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@tests/unit/test_query_cli.py`:
- Around line 130-149: Add a new test method to cover the time_delta-only
empty-ARG path. Create a test similar to test_empty_arg_with_report_filter and
test_empty_arg_with_workspace that invokes the query command with the time_delta
flag (using -d parameter) and --driver local but no ARG value, then verify the
results are returned successfully by asserting the exit code is 0, no exception
occurred, and the expected vulnerability results are present.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: be8060dd-10b5-4963-b84a-08e6d082b2ed

📥 Commits

Reviewing files that changed from the base of the PR and between 2164993 and 9f38a25.

📒 Files selected for processing (2)

• secator/cli.py
• tests/unit/test_query_cli.py