fix: validate SELECT columns as bare identifiers and reject expressions

Non-aggregate SELECT items must be bare column names or *. Rejects
arithmetic (age + 1), aggregate wrappers (COUNT(*) + 1), and FILTER
clauses at parse time with clear error messages.

Author: yeongseon

src/excel_dbapi/parser.py

@@ -213,6 +213,11 @@ def _parse_columns(columns_token: str) -> List[Any]:
                 )
             columns.append({"type": "aggregate", "func": func, "arg": arg})
             continue
+        if column != "*" and not re.fullmatch(r"[A-Za-z_][A-Za-z0-9_]*", column):
+            raise ValueError(
+                f"Unsupported column expression: {column}. "
+                "Only bare column names, *, and aggregate functions are supported"
+            )
         columns.append(column)
     if not columns:
         raise ValueError("Invalid column list")

tests/test_parser.py

@@ -242,3 +242,21 @@ def test_aggregate_rejects_float_literal():
 def test_rejects_window_over():
     with pytest.raises(ValueError):
         parse_sql("SELECT COUNT(*) OVER () FROM users")
+
+
+def test_rejects_arithmetic_in_select():
+    with pytest.raises(ValueError, match="Unsupported column expression"):
+        parse_sql("SELECT age + 1 FROM users")
+
+
+def test_rejects_aggregate_arithmetic_in_select():
+    with pytest.raises(
+        ValueError,
+        match="Unsupported column expression|Unsupported aggregate",
+    ):
+        parse_sql("SELECT COUNT(*) + 1 FROM users")
+
+
+def test_rejects_aggregate_filter_in_select():
+    with pytest.raises(ValueError, match="Unsupported"):
+        parse_sql("SELECT COUNT(*) FILTER (WHERE id > 0) FROM users")