active_shopify_graphql 0.4.0 → 0.5.0

data/lib/active_shopify_graphql/search_query/hash_condition_formatter.rb

@@ -0,0 +1,107 @@
+# frozen_string_literal: true
+
+require_relative "value_sanitizer"
+
+module ActiveShopifyGraphQL
+  class SearchQuery
+    # Formats hash-based query conditions with proper sanitization
+    class HashConditionFormatter
+      # Formats hash conditions into a Shopify search query string
+      # @param conditions [Hash] The conditions to format
+      # @return [String] The formatted query string
+      def self.format(conditions)
+        return "" if conditions.empty?
+
+        query_parts = conditions.map do |key, value|
+          format_condition(key.to_s, value)
+        end
+
+        query_parts.join(" AND ")
+      end
+
+      # Formats a single query condition
+      # @param key [String] The attribute name
+      # @param value [Object] The attribute value
+      # @return [String] The formatted query condition
+      def self.format_condition(key, value)
+        case value
+        when Array
+          format_array_condition(key, value)
+        when String
+          format_string_condition(key, value)
+        when Numeric, true, false
+          "#{key}:#{value}"
+        when Hash
+          format_range_condition(key, value)
+        else
+          "#{key}:#{value}"
+        end
+      end
+
+      # Formats an array condition with OR clauses
+      # @param key [String] The attribute name
+      # @param values [Array] The array of values
+      # @return [String] The formatted query with OR clauses wrapped in parentheses
+      def self.format_array_condition(key, values)
+        return "" if values.empty?
+        return format_condition(key, values.first) if values.size == 1
+
+        or_parts = values.map do |value|
+          format_single_value(key, value)
+        end
+
+        "(#{or_parts.join(' OR ')})"
+      end
+
+      # Formats a single value for use in array OR clauses
+      # @param key [String] The attribute name
+      # @param value [Object] The attribute value
+      # @return [String] The formatted key:value pair
+      def self.format_single_value(key, value)
+        case value
+        when String
+          format_string_condition(key, value)
+        when Numeric, true, false
+          "#{key}:#{value}"
+        else
+          "#{key}:#{value}"
+        end
+      end
+
+      # Formats a string condition with proper quoting and sanitization
+      # @param key [String] The attribute name
+      # @param value [String] The string value
+      # @return [String] The formatted condition
+      def self.format_string_condition(key, value)
+        escaped_value = ValueSanitizer.sanitize(value)
+        "#{key}:'#{escaped_value}'"
+      end
+
+      # Formats a range condition (e.g., { created_at: { gte: '2024-01-01' } })
+      # @param key [String] The attribute name
+      # @param value [Hash] The range conditions
+      # @return [String] The formatted range condition
+      def self.format_range_condition(key, value)
+        range_parts = value.map do |operator, range_value|
+          case operator.to_sym
+          when :gt, :>
+            "#{key}:>#{range_value}"
+          when :gte, :>=
+            "#{key}:>=#{range_value}"
+          when :lt, :<
+            "#{key}:<#{range_value}"
+          when :lte, :<=
+            "#{key}:<=#{range_value}"
+          else
+            raise ArgumentError, "Unsupported range operator: #{operator}"
+          end
+        end
+        range_parts.join(" ")
+      end
+
+      private_class_method :format_condition, :format_array_condition,
+                           :format_single_value, :format_string_condition,
+                           :format_range_condition
+    end
+  end
+end

data/lib/active_shopify_graphql/search_query/parameter_binder.rb

@@ -0,0 +1,68 @@
+# frozen_string_literal: true
+
+require_relative "value_sanitizer"
+
+module ActiveShopifyGraphQL
+  class SearchQuery
+    # Binds parameters to string queries with proper sanitization
+    # Supports both positional (?) and named (:param) placeholders
+    class ParameterBinder
+      # Binds parameters to a query string
+      # @param query_string [String] The query with placeholders
+      # @param args [Array] Positional arguments or a hash of named parameters
+      # @return [String] The query with bound and escaped parameters
+      def self.bind(query_string, *args)
+        return query_string if args.empty?
+
+        if args.first.is_a?(Hash)
+          bind_named_parameters(query_string, args.first)
+        else
+          bind_positional_parameters(query_string, args)
+        end
+      end
+
+      # Binds positional parameters (?)
+      # @param query_string [String] The query with ? placeholders
+      # @param values [Array] The values to bind
+      # @return [String] The query with bound parameters
+      def self.bind_positional_parameters(query_string, values)
+        result = query_string.dup
+        values.each do |value|
+          result = result.sub("?", format_value(value))
+        end
+        result
+      end
+
+      # Binds named parameters (:name)
+      # @param query_string [String] The query with :name placeholders
+      # @param params [Hash] The parameters hash
+      # @return [String] The query with bound parameters
+      def self.bind_named_parameters(query_string, params)
+        result = query_string.dup
+        params.each do |key, value|
+          placeholder = ":#{key}"
+          result = result.gsub(placeholder, format_value(value))
+        end
+        result
+      end
+
+      # Formats a value for safe insertion into query
+      # @param value [Object] The value to format
+      # @return [String] The formatted value
+      def self.format_value(value)
+        case value
+        when String
+          "'#{ValueSanitizer.sanitize(value)}'"
+        when Numeric, true, false
+          value.to_s
+        when nil
+          "null"
+        else
+          "'#{ValueSanitizer.sanitize(value.to_s)}'"
+        end
+      end
+
+      private_class_method :bind_positional_parameters, :bind_named_parameters, :format_value
+    end
+  end
+end

data/lib/active_shopify_graphql/search_query/value_sanitizer.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+module ActiveShopifyGraphQL
+  class SearchQuery
+    # Sanitizes values by escaping special characters for Shopify search syntax
+    class ValueSanitizer
+      # Sanitizes a value by escaping special characters
+      # @param value [String] The value to sanitize
+      # @return [String] The sanitized value
+      def self.sanitize(value)
+        value
+          .gsub('\\', '\\\\\\\\') # Escape backslashes first: \ becomes \\
+          .gsub('"', '\\"') # Escape double quotes with a single backslash
+          # Escape single quotes: O'Reilly becomes O\\'Reilly
+          # Why 4 backslashes? The escaping happens in layers:
+          # 1. Ruby string literal: "\\\\\\\\''" = literal string "\\\\''"
+          # 2. String interpolation in "#{key}:'#{escaped_value}'": the \\\' becomes \\'
+          # 3. Final GraphQL query: customers(query: "title:'O\\'Reilly'")
+          # The double backslash is required by Shopify's search syntax to properly escape the single quote
+          .gsub("'", "\\\\\\\\'")
+      end
+    end
+  end
+end

data/lib/active_shopify_graphql/search_query.rb

@@ -1,103 +1,53 @@
 # frozen_string_literal: true
 
+require_relative "search_query/hash_condition_formatter"
+require_relative "search_query/parameter_binder"
+
 module ActiveShopifyGraphQL
   # Represents a Shopify search query, converting Ruby conditions into Shopify's search syntax
+  # Supports hash-based conditions (with sanitization), string-based conditions (raw), and parameter binding
+  #
+  # @example Hash-based query (safe, with sanitization)
+  #   SearchQuery.new(sku: "ABC-123").to_s
+  #   # => "sku:'ABC-123'"
+  #
+  # @example String-based query (raw, user responsibility for safety)
+  #   SearchQuery.new("sku:* AND product_id:123").to_s
+  #   # => "sku:* AND product_id:123"
+  #
+  # @example String with positional parameter binding
+  #   SearchQuery.new("sku:? product_id:?", "Good ol' value", 123).to_s
+  #   # => "sku:'Good ol\\' value' product_id:123"
+  #
+  # @example String with named parameter binding
+  #   SearchQuery.new("sku::sku product_id::product_id", { sku: "A-SKU", product_id: 123 }).to_s
+  #   # => "sku:'A-SKU' product_id:123"
   class SearchQuery
-    def initialize(conditions = {})
+    def initialize(conditions = {}, *args)
       @conditions = conditions
+      @args = args
     end
 
     # Converts conditions to Shopify search query string
     # @return [String] The Shopify query string
     def to_s
-      return "" if @conditions.empty?
-
-      query_parts = @conditions.map do |key, value|
-        format_condition(key.to_s, value)
-      end
-
-      query_parts.join(" AND ")
-    end
-
-    private
-
-    # Formats a single query condition into Shopify's query syntax
-    # @param key [String] The attribute name
-    # @param value [Object] The attribute value
-    # @return [String] The formatted query condition
-    def format_condition(key, value)
-      case value
-      when Array
-        format_array_condition(key, value)
-      when String
-        format_string_condition(key, value)
-      when Numeric, true, false
-        "#{key}:#{value}"
+      case @conditions
       when Hash
-        format_range_condition(key, value)
-      else
-        "#{key}:#{value}"
-      end
-    end
-
-    # Formats an array condition with OR clauses
-    # @param key [String] The attribute name
-    # @param values [Array] The array of values
-    # @return [String] The formatted query with OR clauses wrapped in parentheses
-    def format_array_condition(key, values)
-      return "" if values.empty?
-      return format_condition(key, values.first) if values.size == 1
-
-      or_parts = values.map do |value|
-        format_single_value(key, value)
-      end
-
-      "(#{or_parts.join(' OR ')})"
-    end
-
-    # Formats a single value for use in array OR clauses
-    # @param key [String] The attribute name
-    # @param value [Object] The attribute value
-    # @return [String] The formatted key:value pair
-    def format_single_value(key, value)
-      case value
+        HashConditionFormatter.format(@conditions)
       when String
-        format_string_condition(key, value)
-      when Numeric, true, false
-        "#{key}:#{value}"
-      else
-        "#{key}:#{value}"
-      end
-    end
-
-    # Formats a string condition with proper quoting
-    def format_string_condition(key, value)
-      # Handle special string values and escape quotes
-      if value.include?(" ") && !value.start_with?('"')
-        # Multi-word values should be quoted
-        "#{key}:\"#{value.gsub('"', '\\"')}\""
-      else
-        "#{key}:#{value}"
-      end
-    end
-
-    # Formats a range condition (e.g., { created_at: { gte: '2024-01-01' } })
-    def format_range_condition(key, value)
-      range_parts = value.map do |operator, range_value|
-        case operator.to_sym
-        when :gt, :>
-          "#{key}:>#{range_value}"
-        when :gte, :>=
-          "#{key}:>=#{range_value}"
-        when :lt, :<
-          "#{key}:<#{range_value}"
-        when :lte, :<=
-          "#{key}:<=#{range_value}"
+        if @args.empty?
+          @conditions
         else
-          raise ArgumentError, "Unsupported range operator: #{operator}"
+          ParameterBinder.bind(@conditions, *@args)
         end
+      when Array
+        # Handle [query_string, *binding_args] format from FinderMethods#where
+        query_string = @conditions.first
+        binding_args = @conditions[1..]
+        ParameterBinder.bind(query_string, *binding_args)
+      else
+        ""
       end
-      range_parts.join(" ")
     end
   end
 end

data/lib/active_shopify_graphql/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module ActiveShopifyGraphQL
-  VERSION = "0.4.0"
+  VERSION = "0.5.0"
 end

data/lib/active_shopify_graphql.rb

@@ -1,37 +1,37 @@
 # frozen_string_literal: true
 
-require 'active_support'
-require 'active_support/inflector'
-require 'active_support/concern'
-require 'active_support/core_ext/object/blank'
-require 'active_model'
-require 'globalid'
+require "active_support"
+require "active_support/concern"
+require "active_model"
+require "active_model/attribute_assignment"
+require "active_model/validations"
+require "active_model/naming"
+require "globalid"
 
-require_relative "active_shopify_graphql/version"
-require_relative "active_shopify_graphql/configuration"
-require_relative "active_shopify_graphql/gid_helper"
-require_relative "active_shopify_graphql/graphql_type_resolver"
-require_relative "active_shopify_graphql/loader_context"
-require_relative "active_shopify_graphql/query_node"
-require_relative "active_shopify_graphql/fragment_builder"
-require_relative "active_shopify_graphql/query_tree"
-require_relative "active_shopify_graphql/response_mapper"
-require_relative "active_shopify_graphql/connection_loader"
-require_relative "active_shopify_graphql/loader"
-require_relative "active_shopify_graphql/loaders/admin_api_loader"
-require_relative "active_shopify_graphql/loaders/customer_account_api_loader"
-require_relative "active_shopify_graphql/loader_switchable"
-require_relative "active_shopify_graphql/finder_methods"
-require_relative "active_shopify_graphql/associations"
-require_relative "active_shopify_graphql/graphql_associations"
-require_relative "active_shopify_graphql/includes_scope"
-require_relative "active_shopify_graphql/connections"
-require_relative "active_shopify_graphql/attributes"
-require_relative "active_shopify_graphql/metafield_attributes"
-require_relative "active_shopify_graphql/search_query"
-require_relative "active_shopify_graphql/base"
+require "zeitwerk"
+loader = Zeitwerk::Loader.for_gem
+loader.inflector.inflect(
+  "active_shopify_graphql" => "ActiveShopifyGraphQL",
+  "graphql_associations" => "GraphQLAssociations"
+)
+loader.setup
 
 module ActiveShopifyGraphQL
   class Error < StandardError; end
   class ObjectNotFoundError < Error; end
+
+  class << self
+    def configuration
+      @configuration ||= Configuration.new
+    end
+
+    def configure
+      yield(configuration)
+    end
+
+    # Reset configuration (useful for testing)
+    def reset_configuration!
+      @configuration = Configuration.new
+    end
+  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: active_shopify_graphql
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.5.0
 platform: ruby
 authors:
 - Nicolò Rebughini
@@ -52,6 +52,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.3'
+- !ruby/object:Gem::Dependency
+  name: zeitwerk
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.6'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.6'
 description: ActiveShopifyGraphQL provides an ActiveRecord-like interface for interacting
   with Shopify's GraphQL APIs, supporting both Admin API and Customer Account API
   with automatic query building and response mapping.
@@ -69,29 +83,46 @@ files:
 - README.md
 - Rakefile
 - lib/active_shopify_graphql.rb
-- lib/active_shopify_graphql/associations.rb
-- lib/active_shopify_graphql/attributes.rb
-- lib/active_shopify_graphql/base.rb
 - lib/active_shopify_graphql/configuration.rb
-- lib/active_shopify_graphql/connection_loader.rb
-- lib/active_shopify_graphql/connections.rb
+- lib/active_shopify_graphql/connections/connection_loader.rb
 - lib/active_shopify_graphql/connections/connection_proxy.rb
-- lib/active_shopify_graphql/finder_methods.rb
-- lib/active_shopify_graphql/fragment_builder.rb
 - lib/active_shopify_graphql/gid_helper.rb
 - lib/active_shopify_graphql/graphql_associations.rb
-- lib/active_shopify_graphql/graphql_type_resolver.rb
-- lib/active_shopify_graphql/includes_scope.rb
 - lib/active_shopify_graphql/loader.rb
 - lib/active_shopify_graphql/loader_context.rb
-- lib/active_shopify_graphql/loader_switchable.rb
+- lib/active_shopify_graphql/loader_proxy.rb
 - lib/active_shopify_graphql/loaders/admin_api_loader.rb
 - lib/active_shopify_graphql/loaders/customer_account_api_loader.rb
-- lib/active_shopify_graphql/metafield_attributes.rb
-- lib/active_shopify_graphql/query_node.rb
-- lib/active_shopify_graphql/query_tree.rb
-- lib/active_shopify_graphql/response_mapper.rb
+- lib/active_shopify_graphql/model.rb
+- lib/active_shopify_graphql/model/associations.rb
+- lib/active_shopify_graphql/model/attributes.rb
+- lib/active_shopify_graphql/model/connections.rb
+- lib/active_shopify_graphql/model/finder_methods.rb
+- lib/active_shopify_graphql/model/graphql_type_resolver.rb
+- lib/active_shopify_graphql/model/loader_switchable.rb
+- lib/active_shopify_graphql/model/metafield_attributes.rb
+- lib/active_shopify_graphql/model_builder.rb
+- lib/active_shopify_graphql/query/node.rb
+- lib/active_shopify_graphql/query/node/collection.rb
+- lib/active_shopify_graphql/query/node/connection.rb
+- lib/active_shopify_graphql/query/node/current_customer.rb
+- lib/active_shopify_graphql/query/node/field.rb
+- lib/active_shopify_graphql/query/node/fragment.rb
+- lib/active_shopify_graphql/query/node/nested_connection.rb
+- lib/active_shopify_graphql/query/node/raw.rb
+- lib/active_shopify_graphql/query/node/root_connection.rb
+- lib/active_shopify_graphql/query/node/single_record.rb
+- lib/active_shopify_graphql/query/node/singular.rb
+- lib/active_shopify_graphql/query/query_builder.rb
+- lib/active_shopify_graphql/query/relation.rb
+- lib/active_shopify_graphql/query/scope.rb
+- lib/active_shopify_graphql/response/page_info.rb
+- lib/active_shopify_graphql/response/paginated_result.rb
+- lib/active_shopify_graphql/response/response_mapper.rb
 - lib/active_shopify_graphql/search_query.rb
+- lib/active_shopify_graphql/search_query/hash_condition_formatter.rb
+- lib/active_shopify_graphql/search_query/parameter_binder.rb
+- lib/active_shopify_graphql/search_query/value_sanitizer.rb
 - lib/active_shopify_graphql/version.rb
 homepage: https://github.com/nebulab/active_shopify_graphql
 licenses:

data/lib/active_shopify_graphql/associations.rb

@@ -1,94 +0,0 @@
-# frozen_string_literal: true
-
-module ActiveShopifyGraphQL
-  # Handles associations between ActiveShopifyGraphQL objects and ActiveRecord objects
-  module Associations
-    extend ActiveSupport::Concern
-
-    included do
-      class << self
-        attr_accessor :associations
-      end
-
-      self.associations = {}
-    end
-
-    class_methods do
-      def has_many(name, class_name: nil, foreign_key: nil, primary_key: nil)
-        association_class_name = class_name || name.to_s.classify
-        association_foreign_key = foreign_key || "shopify_#{model_name.element.downcase}_id"
-        association_primary_key = primary_key || :id
-
-        # Store association metadata
-        associations[name] = {
-          type: :has_many,
-          class_name: association_class_name,
-          foreign_key: association_foreign_key,
-          primary_key: association_primary_key
-        }
-
-        # Define the association method
-        define_method name do
-          return @_association_cache[name] if @_association_cache&.key?(name)
-
-          @_association_cache ||= {}
-
-          primary_key_value = send(association_primary_key)
-          return @_association_cache[name] = [] if primary_key_value.blank?
-
-          association_class = association_class_name.constantize
-          @_association_cache[name] = association_class.where(association_foreign_key => primary_key_value)
-        end
-
-        # Define the association setter method for testing/mocking
-        define_method "#{name}=" do |value|
-          @_association_cache ||= {}
-          @_association_cache[name] = value
-        end
-      end
-
-      def has_one(name, class_name: nil, foreign_key: nil, primary_key: nil)
-        association_class_name = class_name || name.to_s.classify
-        association_foreign_key = foreign_key || "shopify_#{model_name.element.downcase}_id"
-        association_primary_key = primary_key || :id
-
-        # Store association metadata
-        associations[name] = {
-          type: :has_one,
-          class_name: association_class_name,
-          foreign_key: association_foreign_key,
-          primary_key: association_primary_key
-        }
-
-        # Define the association method
-        define_method name do
-          return @_association_cache[name] if @_association_cache&.key?(name)
-
-          @_association_cache ||= {}
-
-          primary_key_value = send(association_primary_key)
-          return @_association_cache[name] = nil if primary_key_value.blank?
-
-          # Extract numeric ID from Shopify GID if needed
-          if primary_key_value.is_a?(String)
-            begin
-              parsed_gid = URI::GID.parse(primary_key_value)
-              primary_key_value = parsed_gid.model_id
-            rescue URI::InvalidURIError, URI::BadURIError, ArgumentError
-              # Not a GID, use value as-is
-            end
-          end
-
-          association_class = association_class_name.constantize
-          @_association_cache[name] = association_class.find_by(association_foreign_key => primary_key_value)
-        end
-
-        # Define the association setter method for testing/mocking
-        define_method "#{name}=" do |value|
-          @_association_cache ||= {}
-          @_association_cache[name] = value
-        end
-      end
-    end
-  end
-end

data/lib/active_shopify_graphql/attributes.rb

@@ -1,50 +0,0 @@
-# frozen_string_literal: true
-
-module ActiveShopifyGraphQL
-  module Attributes
-    extend ActiveSupport::Concern
-
-    class_methods do
-      # Define an attribute with automatic GraphQL path inference and type coercion.
-      #
-      # @param name [Symbol] The Ruby attribute name
-      # @param path [String] The GraphQL field path (auto-inferred if not provided)
-      # @param type [Symbol] The type for coercion (:string, :integer, :float, :boolean, :datetime)
-      # @param null [Boolean] Whether the attribute can be null (default: true)
-      # @param default [Object] Default value when GraphQL response is nil
-      # @param transform [Proc] Custom transform block for the value
-      # @param raw_graphql [String] Raw GraphQL string to inject directly (escape hatch for unsupported features)
-      def attribute(name, path: nil, type: :string, null: true, default: nil, transform: nil, raw_graphql: nil)
-        path ||= infer_path(name)
-        config = { path: path, type: type, null: null, default: default, transform: transform, raw_graphql: raw_graphql }
-
-        if @current_loader_context
-          # Store in loader-specific context
-          @loader_contexts[@current_loader_context][name] = config
-        else
-          # Store in base attributes
-          @base_attributes ||= {}
-          @base_attributes[name] = config
-        end
-
-        # Always create attr_accessor
-        attr_accessor name unless method_defined?(name) || method_defined?("#{name}=")
-      end
-
-      # Get attributes for a specific loader class, merging base with loader-specific overrides.
-      def attributes_for_loader(loader_class)
-        base = @base_attributes || {}
-        overrides = @loader_contexts&.dig(loader_class) || {}
-
-        base.merge(overrides) { |_key, base_val, override_val| base_val.merge(override_val) }
-      end
-
-      private
-
-      # Infer GraphQL path from Ruby attribute name (snake_case -> camelCase)
-      def infer_path(name)
-        name.to_s.gsub(/_([a-z])/) { ::Regexp.last_match(1).upcase }
-      end
-    end
-  end
-end