Major version update. Major bugfixes. Security vulnerabilites fixed
This commit is contained in:
Vendored
+86
-88
@@ -1,29 +1,23 @@
|
||||
import sqlGenGenSearchStr from "./sql-generator-gen-search-str";
|
||||
import sqlGenGenQueryStr from "./sql-generator-gen-query-str";
|
||||
import { sqlField, sqlIdent, sqlInt, sqlOperator, sqlOrderStrategy, } from "./sql-safe";
|
||||
/**
|
||||
* # SQL Query Generator
|
||||
* @description Generates an SQL Query for node module `mysql` or `serverless-mysql`
|
||||
* @description Generates a parameterized SQLite SELECT query. All values are
|
||||
* returned in `values` to be bound; identifiers are validated.
|
||||
*/
|
||||
export default function sqlGenerator({ tableName, genObject, dbFullName, count }) {
|
||||
export default function sqlGenerator({ tableName: passedTableName, genObject, count, targetId, }) {
|
||||
const tableName = sqlIdent(passedTableName, "table name");
|
||||
const finalQuery = genObject?.query ? genObject.query : undefined;
|
||||
const queryKeys = finalQuery ? Object.keys(finalQuery) : undefined;
|
||||
const sqlSearhValues = [];
|
||||
let fullTextMatchStr = genObject?.fullTextSearch
|
||||
? ` MATCH(${genObject.fullTextSearch.fields
|
||||
.map((f) => genObject.join ? `${tableName}.${String(f)}` : `${String(f)}`)
|
||||
.join(",")}) AGAINST (? IN BOOLEAN MODE)`
|
||||
: undefined;
|
||||
const fullTextSearchStr = genObject?.fullTextSearch
|
||||
? genObject.fullTextSearch.searchTerm
|
||||
.split(` `)
|
||||
.map((t) => `${t}`)
|
||||
.join(" ")
|
||||
: undefined;
|
||||
const whereValues = [];
|
||||
if (genObject?.fullTextSearch) {
|
||||
throw new Error("`fullTextSearch` is not supported by SQLite. Use an FTS5 table and the `MATCH` equality instead.");
|
||||
}
|
||||
let { str: queryString, values } = sqlGenGenQueryStr({
|
||||
table_name: tableName,
|
||||
append_table_names: true,
|
||||
full_text_match_str: fullTextMatchStr,
|
||||
full_text_search_str: fullTextSearchStr,
|
||||
genObject,
|
||||
});
|
||||
sqlSearhValues.push(...values);
|
||||
@@ -34,7 +28,8 @@ export default function sqlGenerator({ tableName, genObject, dbFullName, count }
|
||||
if (queryObj.__query) {
|
||||
const subQueryGroup = queryObj.__query;
|
||||
const subSearchKeys = Object.keys(subQueryGroup);
|
||||
const subSearchString = subSearchKeys.map((_field) => {
|
||||
const subSearchString = subSearchKeys
|
||||
.map((_field) => {
|
||||
const newSubQueryObj = subQueryGroup?.[_field];
|
||||
if (newSubQueryObj) {
|
||||
const { str, values } = sqlGenGenSearchStr({
|
||||
@@ -43,12 +38,15 @@ export default function sqlGenerator({ tableName, genObject, dbFullName, count }
|
||||
join: genObject?.join,
|
||||
table_name: tableName,
|
||||
});
|
||||
sqlSearhValues.push(...values);
|
||||
whereValues.push(...values);
|
||||
return str;
|
||||
}
|
||||
});
|
||||
})
|
||||
.filter((str) => typeof str == "string");
|
||||
if (!subSearchString.length)
|
||||
return;
|
||||
return ("(" +
|
||||
subSearchString.join(` ${queryObj.operator || "AND"} `) +
|
||||
subSearchString.join(` ${sqlOperator(queryObj.operator)} `) +
|
||||
")");
|
||||
}
|
||||
const { str, values } = sqlGenGenSearchStr({
|
||||
@@ -57,96 +55,96 @@ export default function sqlGenerator({ tableName, genObject, dbFullName, count }
|
||||
join: genObject?.join,
|
||||
table_name: tableName,
|
||||
});
|
||||
sqlSearhValues.push(...values);
|
||||
whereValues.push(...values);
|
||||
return str;
|
||||
});
|
||||
const cleanedUpSearchStr = sqlSearhString?.filter((str) => typeof str == "string");
|
||||
const isSearchStr = cleanedUpSearchStr?.[0] && cleanedUpSearchStr.find((str) => str);
|
||||
if (isSearchStr) {
|
||||
const stringOperator = genObject?.searchOperator || "AND";
|
||||
queryString += ` WHERE ${cleanedUpSearchStr.join(` ${stringOperator} `)}`;
|
||||
const whereConditions = [];
|
||||
if (cleanedUpSearchStr?.[0]) {
|
||||
const stringOperator = sqlOperator(genObject?.searchOperator);
|
||||
whereConditions.push(`(${cleanedUpSearchStr.join(` ${stringOperator} `)})`);
|
||||
}
|
||||
if (genObject?.fullTextSearch && fullTextSearchStr && fullTextMatchStr) {
|
||||
queryString += `${isSearchStr ? " AND" : " WHERE"} ${fullTextMatchStr}`;
|
||||
sqlSearhValues.push(fullTextSearchStr);
|
||||
if (targetId !== undefined && targetId !== null && targetId !== "") {
|
||||
const id = Number(targetId);
|
||||
if (!Number.isSafeInteger(id)) {
|
||||
throw new Error(`Invalid targetId: ${JSON.stringify(targetId)}`);
|
||||
}
|
||||
whereConditions.push(`${genObject?.join ? `${tableName}.` : ""}id = ?`);
|
||||
whereValues.push(id);
|
||||
}
|
||||
const whereString = whereConditions.length
|
||||
? `WHERE ${whereConditions.join(" AND ")}`
|
||||
: "";
|
||||
if (whereString) {
|
||||
queryString += ` ${whereString}`;
|
||||
sqlSearhValues.push(...whereValues);
|
||||
}
|
||||
if (genObject?.group) {
|
||||
let group_by_txt = ``;
|
||||
if (typeof genObject.group == "string") {
|
||||
group_by_txt = genObject.group;
|
||||
}
|
||||
else if (Array.isArray(genObject.group)) {
|
||||
for (let i = 0; i < genObject.group.length; i++) {
|
||||
const group = genObject.group[i];
|
||||
if (typeof group == "string") {
|
||||
group_by_txt += `\`${group.toString()}\``;
|
||||
}
|
||||
else if (typeof group == "object" && group.table) {
|
||||
group_by_txt += `${group.table}.${String(group.field)}`;
|
||||
}
|
||||
else if (typeof group == "object") {
|
||||
group_by_txt += `${String(group.field)}`;
|
||||
}
|
||||
if (i < genObject.group.length - 1) {
|
||||
group_by_txt += ",";
|
||||
}
|
||||
const grabGroupStr = (group) => {
|
||||
if (typeof group == "object") {
|
||||
return group.table
|
||||
? `${sqlIdent(group.table, "table name")}.${sqlIdent(group.field, "field name")}`
|
||||
: sqlField(group.field);
|
||||
}
|
||||
}
|
||||
else if (typeof genObject.group == "object") {
|
||||
if (genObject.group.table) {
|
||||
group_by_txt = `${genObject.group.table}.${String(genObject.group.field)}`;
|
||||
}
|
||||
else {
|
||||
group_by_txt = `${String(genObject.group.field)}`;
|
||||
}
|
||||
}
|
||||
return sqlField(group);
|
||||
};
|
||||
const group_by_txt = Array.isArray(genObject.group)
|
||||
? genObject.group.map(grabGroupStr).join(",")
|
||||
: grabGroupStr(genObject.group);
|
||||
queryString += ` GROUP BY ${group_by_txt}`;
|
||||
}
|
||||
function grabOrderString(order) {
|
||||
let orderFields = [];
|
||||
let orderSrt = ``;
|
||||
if (genObject?.fullTextSearch && genObject.fullTextSearch.scoreAlias) {
|
||||
orderFields.push(genObject.fullTextSearch.scoreAlias);
|
||||
}
|
||||
else if (genObject?.join) {
|
||||
orderFields.push(`${tableName}.${String(order.field)}`);
|
||||
}
|
||||
else {
|
||||
orderFields.push(order.field);
|
||||
}
|
||||
orderSrt += ` ${orderFields.join(", ")} ${order.strategy}`;
|
||||
return orderSrt;
|
||||
const field = genObject?.join && !String(order.field).includes(".")
|
||||
? `${tableName}.${sqlIdent(order.field, "order field")}`
|
||||
: sqlField(order.field, "order field");
|
||||
return ` ${field} ${sqlOrderStrategy(order.strategy)}`;
|
||||
}
|
||||
if (genObject?.order) {
|
||||
let orderSrt = ` ORDER BY`;
|
||||
if (Array.isArray(genObject.order)) {
|
||||
for (let i = 0; i < genObject.order.length; i++) {
|
||||
const order = genObject.order[i];
|
||||
if (order) {
|
||||
orderSrt +=
|
||||
grabOrderString(order) +
|
||||
(i < genObject.order.length - 1 ? `,` : "");
|
||||
}
|
||||
}
|
||||
}
|
||||
else {
|
||||
orderSrt += grabOrderString(genObject.order);
|
||||
}
|
||||
const orders = (Array.isArray(genObject.order) ? genObject.order : [genObject.order]).filter(Boolean);
|
||||
orderSrt += orders.map(grabOrderString).join(",");
|
||||
queryString += ` ${orderSrt}`;
|
||||
}
|
||||
if (genObject?.limit && !count)
|
||||
queryString += ` LIMIT ${genObject.limit}`;
|
||||
if (genObject?.offset) {
|
||||
queryString += ` OFFSET ${genObject.offset}`;
|
||||
}
|
||||
else if (genObject?.page && genObject.limit && !count) {
|
||||
queryString += ` OFFSET ${(genObject.page - 1) * genObject.limit}`;
|
||||
/**
|
||||
* Pagination is skipped for count queries so the count covers every
|
||||
* matching row
|
||||
*/
|
||||
if (!count) {
|
||||
const { limit: rawLimit, offset: rawOffset, page } = genObject || {};
|
||||
/**
|
||||
* `limit: 0` has always meant "no limit"
|
||||
*/
|
||||
const limit = rawLimit ? sqlInt(rawLimit, "limit") : undefined;
|
||||
const offset = isSet(rawOffset)
|
||||
? sqlInt(rawOffset, "offset")
|
||||
: isSet(page) && limit !== undefined
|
||||
? Math.max(sqlInt(page, "page") - 1, 0) * limit
|
||||
: undefined;
|
||||
if (limit !== undefined) {
|
||||
queryString += ` LIMIT ${limit}`;
|
||||
}
|
||||
else if (offset) {
|
||||
/**
|
||||
* SQLite doesn't allow OFFSET without LIMIT
|
||||
*/
|
||||
queryString += ` LIMIT -1`;
|
||||
}
|
||||
if (offset) {
|
||||
queryString += ` OFFSET ${offset}`;
|
||||
}
|
||||
}
|
||||
return {
|
||||
string: queryString,
|
||||
values: sqlSearhValues,
|
||||
where: {
|
||||
string: whereString,
|
||||
values: whereString ? whereValues : [],
|
||||
},
|
||||
};
|
||||
}
|
||||
function isSet(val) {
|
||||
return val !== undefined && val !== null;
|
||||
}
|
||||
// let queryString = (() => {
|
||||
// let str = "SELECT";
|
||||
// if (genObject?.select_sql) {
|
||||
|
||||
Reference in New Issue
Block a user