bun-sqlite/tests/sql-generator.test.ts

import { describe, expect, test } from "bun:test";
import sqlGenerator from "../src/utils/sql-generator";

const gen = (genObject: any, extra: Record<string, any> = {}) =>
    sqlGenerator({ tableName: "users", genObject, ...extra });

describe("identifiers", () => {
    test("binds values and keeps identifiers", () => {
        const { string, values } = gen({ query: { email: { value: "[email protected]" } } });
        expect(string).toBe("SELECT * FROM `users` WHERE (`email` = ?)");
        expect(values).toEqual(["[email protected]"]);
    });

    test.each([
        ["field name", { query: { "1=1 OR id": { value: 1 } } }],
        ["quoted field name", { query: { 'a" OR 1=1 --': { value: 1 } } }],
        ["select field", { selectFields: ["name; DROP TABLE users"] }],
    ])("rejects an injected %s", (_name, genObject) => {
        expect(() => gen(genObject)).toThrow();
    });

    test("rejects an injected table name", () => {
        expect(() =>
            sqlGenerator({ tableName: "users; DROP TABLE users", genObject: {} }),
        ).toThrow();
    });
});

describe("input validation", () => {
    test.each([
        ["order strategy", { order: { field: "id", strategy: "DESC; DROP TABLE x" } }],
        ["limit", { limit: "1; --" }],
        ["negative offset", { offset: -1 }],
        ["page", { limit: 10, page: "2 OR 1" }],
        ["search operator", { query: { a: { value: 1 } }, searchOperator: "OR 1=1" }],
        ["raw equality", { query: { a: { value: 1, raw_equality: "= 1 OR" } } }],
        ["join type", { join: [{ tableName: "p", joinType: "CROSS JOIN x;", match: { source: "id", target: "uid" } }] }],
    ])("rejects invalid %s", (_name, genObject) => {
        expect(() => gen(genObject)).toThrow();
    });

    test("rejects non-numeric targetId", () => {
        expect(() => gen({}, { targetId: "abc" })).toThrow();
    });
});

describe("targetId", () => {
    test("is ANDed with the query, even with searchOperator OR", () => {
        const { string, values } = gen(
            { query: { a: { value: 1 }, b: { value: 2 } }, searchOperator: "OR" },
            { targetId: 5 },
        );
        expect(string).toBe(
            "SELECT * FROM `users` WHERE (`a` = ? OR `b` = ?) AND id = ?",
        );
        expect(values).toEqual([1, 2, 5]);
    });

    test("accepts numeric strings", () => {
        const { string, values } = gen({}, { targetId: "7" });
        expect(string).toBe("SELECT * FROM `users` WHERE id = ?");
        expect(values).toEqual([7]);
    });

    test("0 is a real id", () => {
        expect(gen({}, { targetId: 0 }).values).toEqual([0]);
    });

    test("is table-qualified with joins", () => {
        const { string } = gen(
            {
                join: [
                    {
                        tableName: "posts",
                        joinType: "LEFT JOIN",
                        match: { source: "id", target: "user_id" },
                    },
                ],
            },
            { targetId: 3 },
        );
        expect(string).toEndWith("WHERE `users`.id = ?");
    });

    test("is part of the where clause used by update / delete", () => {
        const { where } = gen({ query: { a: { value: 1 } } }, { targetId: 2 });
        expect(where).toEqual({
            string: "WHERE (`a` = ?) AND id = ?",
            values: [1, 2],
        });
    });
});

describe("values", () => {
    test("0 is a real value", () => {
        expect(gen({ query: { age: { value: 0 } } }).values).toEqual([0]);
    });

    test("IN binds each value", () => {
        const { string, values } = gen({
            query: { id: { value: [1, 2], equality: "IN" } },
        });
        expect(string).toBe("SELECT * FROM `users` WHERE (`id` IN (?, ?))");
        expect(values).toEqual([1, 2]);
    });

    test("empty IN matches nothing, empty NOT IN matches everything", () => {
        expect(gen({ query: { id: { value: [], equality: "IN" } } }).string).toBe(
            "SELECT * FROM `users` WHERE (1 = 0)",
        );
        expect(
            gen({ query: { id: { value: [], equality: "NOT IN" } } }).string,
        ).toBe("SELECT * FROM `users` WHERE (1 = 1)");
    });

    test("BETWEEN needs exactly two values", () => {
        expect(() =>
            gen({ query: { age: { value: [1], equality: "BETWEEN" } } }),
        ).toThrow();
    });
});

describe("pagination", () => {
    test("page is converted to an offset", () => {
        expect(gen({ limit: 10, page: 3 }).string).toBe(
            "SELECT * FROM `users` LIMIT 10 OFFSET 20",
        );
    });

    test("count queries skip pagination", () => {
        expect(gen({ limit: 10, page: 3 }, { count: true }).string).not.toContain(
            "LIMIT",
        );
    });
});