tbenandClaude Opus 5.5
66f73c4228
Security: - select: bind parameters instead of mysql.format (backslash escaping allowed injection on SQLite); drop the mysql dependency - validate all interpolated identifiers, limit/offset/page, order strategy, operators, join types and raw equalities (new sql-safe.ts) - quote identifiers and bind values in schema manager DDL/queries Data loss: - schema sync runs with foreign keys off inside a transaction, with foreign_key_check before commit (DROP TABLE no longer cascades) - parentTableName tables: stop mutating the parent schema and copy inherited columns on rebuild - keep column data on type changes (match columns by name) - backups and schema snapshots use VACUUM INTO (includes WAL data); restore closes the DB, clears -wal/-shm, and swaps atomically - backup listing/trimming only touches <db_name>-<timestamp> files Correctness: - update/delete use the generator's WHERE clause instead of a regex - keep 0/""/false values; booleans stored as 0/1 - IN/NOT IN and BETWEEN arrays, NOT LIKE wrapping, AVG, select aliases - OFFSET without LIMIT, count ignores pagination - MATCH emits `field MATCH fn(?)` for sqlite-vec - sql() returns rows for any row-producing statement - targetId no longer mutates the caller's query - init throws instead of process.exit; CLI reports errors Co-Authored-By: Claude Opus 5.5 <[email protected]>
104 lines
2.6 KiB
TypeScript
104 lines
2.6 KiB
TypeScript
import type {
|
|
ServerQueryParamsJoin,
|
|
ServerQueryParamsJoinMatchObject,
|
|
SQLInsertGenValueType,
|
|
} from "../types";
|
|
import { sqlIdent, sqlOperator, sqlRawEquality } from "./sql-safe";
|
|
|
|
type Param = {
|
|
mtch: ServerQueryParamsJoinMatchObject;
|
|
join: ServerQueryParamsJoin;
|
|
table_name: string;
|
|
};
|
|
|
|
export default function sqlGenGenJoinStr({ join, mtch, table_name }: Param) {
|
|
let values: SQLInsertGenValueType[] = [];
|
|
|
|
if (mtch.__batch) {
|
|
let btch_mtch = ``;
|
|
btch_mtch += `(`;
|
|
|
|
for (let i = 0; i < mtch.__batch.matches.length; i++) {
|
|
const __mtch = mtch.__batch.matches[
|
|
i
|
|
] as ServerQueryParamsJoinMatchObject;
|
|
|
|
const { str, values: batch_values } = sqlGenGenJoinStr({
|
|
join,
|
|
mtch: __mtch,
|
|
table_name,
|
|
});
|
|
|
|
btch_mtch += str;
|
|
|
|
values.push(...batch_values);
|
|
|
|
if (i < mtch.__batch.matches.length - 1) {
|
|
btch_mtch += ` ${sqlOperator(mtch.__batch.operator, "OR")} `;
|
|
}
|
|
}
|
|
|
|
btch_mtch += `)`;
|
|
|
|
return {
|
|
str: btch_mtch,
|
|
values,
|
|
};
|
|
}
|
|
|
|
const equality = mtch.raw_equality ? sqlRawEquality(mtch.raw_equality) : "=";
|
|
|
|
const lhs = `${sqlIdent(
|
|
typeof mtch.source == "object" ? mtch.source.tableName : table_name,
|
|
"table name",
|
|
)}.${sqlIdent(
|
|
typeof mtch.source == "object" ? mtch.source.fieldName : mtch.source,
|
|
"field name",
|
|
)}`;
|
|
|
|
if (mtch.between) {
|
|
values.push(mtch.between.min, mtch.between.max);
|
|
|
|
return {
|
|
str: `${lhs} BETWEEN ? AND ?`,
|
|
values,
|
|
};
|
|
}
|
|
|
|
if (mtch.not_between) {
|
|
values.push(mtch.not_between.min, mtch.not_between.max);
|
|
|
|
return {
|
|
str: `${lhs} NOT BETWEEN ? AND ?`,
|
|
values,
|
|
};
|
|
}
|
|
|
|
const rhs = (() => {
|
|
if (mtch.targetLiteral !== undefined && mtch.targetLiteral !== null) {
|
|
values.push(mtch.targetLiteral);
|
|
return `?`;
|
|
}
|
|
|
|
const targetTable =
|
|
typeof mtch.target == "object"
|
|
? mtch.target.tableName
|
|
: join.alias || join.tableName;
|
|
|
|
const targetField =
|
|
typeof mtch.target == "object"
|
|
? mtch.target.fieldName
|
|
: mtch.target;
|
|
|
|
return `${sqlIdent(targetTable, "table name")}.${sqlIdent(
|
|
targetField,
|
|
"field name",
|
|
)}`;
|
|
})();
|
|
|
|
return {
|
|
str: `${lhs} ${equality} ${rhs}`,
|
|
values,
|
|
};
|
|
}
|