import { describe, expect, test } from "bun:test"; import sqlGenerator from "../src/utils/sql-generator"; const gen = (genObject: any, extra: Record = {}) => sqlGenerator({ tableName: "users", genObject, ...extra }); describe("identifiers", () => { test("binds values and keeps identifiers", () => { const { string, values } = gen({ query: { email: { value: "a@b.c" } } }); expect(string).toBe("SELECT * FROM `users` WHERE (`email` = ?)"); expect(values).toEqual(["a@b.c"]); }); test.each([ ["field name", { query: { "1=1 OR id": { value: 1 } } }], ["quoted field name", { query: { 'a" OR 1=1 --': { value: 1 } } }], ["select field", { selectFields: ["name; DROP TABLE users"] }], ])("rejects an injected %s", (_name, genObject) => { expect(() => gen(genObject)).toThrow(); }); test("rejects an injected table name", () => { expect(() => sqlGenerator({ tableName: "users; DROP TABLE users", genObject: {} }), ).toThrow(); }); }); describe("input validation", () => { test.each([ ["order strategy", { order: { field: "id", strategy: "DESC; DROP TABLE x" } }], ["limit", { limit: "1; --" }], ["negative offset", { offset: -1 }], ["page", { limit: 10, page: "2 OR 1" }], ["search operator", { query: { a: { value: 1 } }, searchOperator: "OR 1=1" }], ["raw equality", { query: { a: { value: 1, raw_equality: "= 1 OR" } } }], ["join type", { join: [{ tableName: "p", joinType: "CROSS JOIN x;", match: { source: "id", target: "uid" } }] }], ])("rejects invalid %s", (_name, genObject) => { expect(() => gen(genObject)).toThrow(); }); test("rejects non-numeric targetId", () => { expect(() => gen({}, { targetId: "abc" })).toThrow(); }); }); describe("targetId", () => { test("is ANDed with the query, even with searchOperator OR", () => { const { string, values } = gen( { query: { a: { value: 1 }, b: { value: 2 } }, searchOperator: "OR" }, { targetId: 5 }, ); expect(string).toBe( "SELECT * FROM `users` WHERE (`a` = ? OR `b` = ?) AND id = ?", ); expect(values).toEqual([1, 2, 5]); }); test("accepts numeric strings", () => { const { string, values } = gen({}, { targetId: "7" }); expect(string).toBe("SELECT * FROM `users` WHERE id = ?"); expect(values).toEqual([7]); }); test("0 is a real id", () => { expect(gen({}, { targetId: 0 }).values).toEqual([0]); }); test("is table-qualified with joins", () => { const { string } = gen( { join: [ { tableName: "posts", joinType: "LEFT JOIN", match: { source: "id", target: "user_id" }, }, ], }, { targetId: 3 }, ); expect(string).toEndWith("WHERE `users`.id = ?"); }); test("is part of the where clause used by update / delete", () => { const { where } = gen({ query: { a: { value: 1 } } }, { targetId: 2 }); expect(where).toEqual({ string: "WHERE (`a` = ?) AND id = ?", values: [1, 2], }); }); }); describe("values", () => { test("0 is a real value", () => { expect(gen({ query: { age: { value: 0 } } }).values).toEqual([0]); }); test("IN binds each value", () => { const { string, values } = gen({ query: { id: { value: [1, 2], equality: "IN" } }, }); expect(string).toBe("SELECT * FROM `users` WHERE (`id` IN (?, ?))"); expect(values).toEqual([1, 2]); }); test("empty IN matches nothing, empty NOT IN matches everything", () => { expect(gen({ query: { id: { value: [], equality: "IN" } } }).string).toBe( "SELECT * FROM `users` WHERE (1 = 0)", ); expect( gen({ query: { id: { value: [], equality: "NOT IN" } } }).string, ).toBe("SELECT * FROM `users` WHERE (1 = 1)"); }); test("BETWEEN needs exactly two values", () => { expect(() => gen({ query: { age: { value: [1], equality: "BETWEEN" } } }), ).toThrow(); }); }); describe("pagination", () => { test("page is converted to an offset", () => { expect(gen({ limit: 10, page: 3 }).string).toBe( "SELECT * FROM `users` LIMIT 10 OFFSET 20", ); }); test("count queries skip pagination", () => { expect(gen({ limit: 10, page: 3 }, { count: true }).string).not.toContain( "LIMIT", ); }); });