json2sql 1.0.11 → 1.0.13

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b734e672123b35d6b3878a30bf9629821915140e3240eba21cd8e853ac414911
-  data.tar.gz: 819e7767505a2154f0071a46ffee6640d30954e7bae623f308cb185791f2f1f3
+  metadata.gz: 6282183f873d4f4e32d0c0819c43ffe20ce53dbabd71bb44ba26b362edbaf9d7
+  data.tar.gz: 1aa18874f4bbfc9f1ac395b357babb98f3884f577f2fe8d3d81d7f647cbfc2ba
 SHA512:
-  metadata.gz: 8a0743bbb6f1e26aacf1cdf62e0e81ce19992a79b0c748225a3d563a810ef4d8278b59d068fe28ee8707bb55080130d27538dc6711a2782dc392762aefd92a32
-  data.tar.gz: 90cb0a70a7443c7bd6b3f4c6f12d02298d6e6c906d399cebc02c1edf1c566dc5eef470790d7f9213ef88b266a3b11f39f53fd74eaaa1ca1f37ef8daa015331d8
+  metadata.gz: 7e84fdd24a2efa2eb464d85df3a3ec3b8370d204bb4d64676dcb953e2777bb34d3bc0807eb0e2fc9c65ffb167911ce89a3c3606a7bcb66d20698b0e617801f81
+  data.tar.gz: 9b6f1b82866c8ff0d96af65439ed0a2b6f96592ecde63187b1d91ed27a513d92a3f57077c06862e2582f31342c62f18dabed2f08577a067f358760e5e07161c4

data/lib/json2sql/{input_policy.rb → query_policy.rb}

@@ -6,7 +6,9 @@ module Json2sql
   #   mode:   :allow (default) — only tables listed in `tables:` are accessible.
   #                              Tables absent from `tables:` are blocked entirely.
   #                              Empty `tables:` = no restriction.
-  #           :deny            — all tables pass; only listed columns are stripped.
+  #           :deny            — all tables pass. After column filtering, tables
+  #                              with no remaining accessible columns are removed.
+  #                              Same rule applies to children and parents.
   #   tables: Per-table configuration Hash (recursive):
   #     { table_name => { columns: [...],
   #                       children: { child_table => { columns: [...], ... } },
@@ -25,7 +27,7 @@ module Json2sql
   #               user-supplied values — primary IDOR guard.
   #
   # Usage:
-  #   policy = Json2sql::InputPolicy.new(
+  #   policy = Json2sql::QueryPolicy.new(
   #     mode:   :allow,
   #     tables: {
   #       orders: {
@@ -39,7 +41,7 @@ module Json2sql
   #   safe_input = policy.apply(raw_params)
   #   sql = Json2sql::SelectRunner.build(safe_input)
 
-  class InputPolicy
+  class QueryPolicy
 
     def initialize(mode: :allow, tables: {})
 
@@ -54,73 +56,79 @@ module Json2sql
     def apply(input)
 
       input = Json2sql.normalize(input)
+      
+      filter_tables(input, @tables)
 
-      input = filter_tables(input)
+      input.each { |table, params| sanitize_table(params, @tables[table]) }
 
-      input.each { |table, params| sanitize_table(params, @tables[table] || {}) }
+      input.reject! { |_, params| empty_columns?(params) }
 
       input
     end
 
     private
 
-    def filter_tables(input)
-
-      return input if @mode == :deny || @tables.empty?
-
-      input.select { |table, _| @tables.key?(table) }
-    end
-
     def sanitize_table(params, config)
 
       return unless params.is_a?(Hash)
 
+      return unless config.is_a?(Hash)
+
       filter_columns(params, config)
 
       inject_where(params, config)
 
       %w[children parents].each do |relation|
 
-        if @mode == :deny
+        filter_relations(params, config, relation)
 
-          next unless params[relation].is_a?(Hash)
+        next unless params[relation].is_a?(Hash)
 
-          relation_configs = config[relation].is_a?(Hash) ? config[relation] : {}
+        tables = config[relation].is_a?(Hash) ? config[relation] : {}
 
-          params[relation].each { |child_table, child_params| sanitize_table(child_params, relation_configs[child_table] || {}) }
+        params[relation].each { |table, params| sanitize_table(params, tables[table]) }
 
-          params[relation].reject! { |_, child_params| child_params.is_a?(Hash) && child_params["columns"].is_a?(Array) && child_params["columns"].empty? }
+        params[relation].reject! { |_, params| empty_columns?(params) }
 
-        else
+      end
+    end
 
-          filter_relations(params, config, relation)
+    def empty_columns?(params)
 
-          next unless params[relation].is_a?(Hash)
+      params.is_a?(Hash) && params["columns"].is_a?(Array) && params["columns"].empty?
+    end
 
-          relation_configs = config[relation].is_a?(Hash) ? config[relation] : {}
+    def filter_tables(params, config)
 
-          params[relation].each { |child_table, child_params| sanitize_table(child_params, relation_configs[child_table] || {}) }
+      return if @mode == :deny
 
-        end
-      end
-    end
+      return unless params.is_a?(Hash)
+
+      tables = config.is_a?(Hash) ? config : {}
 
+      return if tables.empty?
+
+      params.select! { |table, _| tables.key?(table) }
+    end
+    
     # Filters children/parents relations in :allow mode.
-    # Only relations present as keys in config[relation_key] pass through.
-    # If config[relation_key] is absent or not a Hash, relations are untouched.
-    # In :deny mode, pruning is handled in sanitize_table after column filtering.
+    # Only relations present as keys in config[relation] pass through.
+    # If config[relation] is absent or not a Hash, relations are untouched.
+    # No-op in :deny mode.
+
+    def filter_relations(params, config, relation)
 
-    def filter_relations(params, config, relation_key)
+      return if @mode == :deny
 
-      relations = params[relation_key]
+      param_tables = params[relation]
 
-      return unless relations.is_a?(Hash)
+      return unless param_tables.is_a?(Hash)
 
-      relation_config = config[relation_key]
+      config_tables = config[relation]
 
-      return unless relation_config.is_a?(Hash)
+      return unless config_tables.is_a?(Hash)
 
-      params[relation_key] = relations.select { |t, _| relation_config.key?(t) }
+      params[relation] = param_tables.select { |table, _| config_tables.key?(table) }
     end
 
     # Filters "columns" using mode (:allow or :deny).

data/lib/json2sql/select_model.rb

@@ -325,15 +325,24 @@ module Json2sql
 
       function = Sanitizer.keyword(column["function"].to_s)
 
-      expression = +"#{function}("
+      params = column["params"]
 
-      glue = false
+      return build_function_cast(params) if function.upcase == "CAST"
+
+      build_function_default(function, params)
+    end
 
-      col_params = column["params"]
+    def build_function_default(function, params)
 
-      if col_params.is_a?(Array)
+      expression = +""
+
+      expression << function << "("
+
+      glue = false
 
-        col_params.each do |param|
+      if params.is_a?(Array)
+
+        params.each do |param|
 
           next unless param.is_a?(String) || param.is_a?(Symbol)
 
@@ -350,6 +359,32 @@ module Json2sql
       expression
     end
 
+    # Supports function payload: {"function"=>"CAST", "params"=>["id", "CHAR"]}
+    # and generic cast targets like SIGNED/UNSIGNED/CHAR.
+
+    def build_function_cast(params)
+
+      return +"NULL" unless params.is_a?(Array) && params.length >= 2
+
+      source = params[0]
+
+      return +"NULL" unless source.is_a?(String) || source.is_a?(Symbol)
+
+      cast_type = Sanitizer.keyword(params[1].to_s).upcase
+
+      return +"NULL" if cast_type.empty?
+
+      expression = +"CAST("
+
+      expression << Sanitizer.keyword_wrap(@table) << "."
+
+      expression << Sanitizer.keyword_wrap(source.to_s)
+
+      expression << " AS " << cast_type << ")"
+
+      expression
+    end
+
     def build_order(params)
 
       order = params["order"]

data/lib/json2sql/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Json2sql
-  VERSION = "1.0.11"
+  VERSION = "1.0.13"
 end

data/lib/json2sql.rb

@@ -10,7 +10,7 @@ require_relative "json2sql/update_model"
 require_relative "json2sql/update_runner"
 require_relative "json2sql/delete_model"
 require_relative "json2sql/delete_runner"
-require_relative "json2sql/input_policy"
+require_relative "json2sql/query_policy"
 
 # Json2sql — SQL builder that generates MySQL/MariaDB query strings from
 # plain Ruby Hashes (or parsed JSON).

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: json2sql
 version: !ruby/object:Gem::Version
-  version: 1.0.11
+  version: 1.0.13
 platform: ruby
 authors:
 - Tiago da Silva
@@ -49,9 +49,9 @@ files:
 - lib/json2sql.rb
 - lib/json2sql/delete_model.rb
 - lib/json2sql/delete_runner.rb
-- lib/json2sql/input_policy.rb
 - lib/json2sql/insert_model.rb
 - lib/json2sql/insert_runner.rb
+- lib/json2sql/query_policy.rb
 - lib/json2sql/sanitizer.rb
 - lib/json2sql/select_model.rb
 - lib/json2sql/select_runner.rb