sequel 5.51.0 → 5.56.0

data/lib/sequel/extensions/sqlite_json_ops.rb

@@ -0,0 +1,255 @@
+# frozen-string-literal: true
+#
+# The sqlite_json_ops extension adds support to Sequel's DSL to make
+# it easier to call SQLite JSON functions and operators (added
+# first in SQLite 3.38.0).
+#
+# To load the extension:
+#
+#   Sequel.extension :sqlite_json_ops
+#
+# This extension works by calling methods on Sequel::SQLite::JSONOp objects,
+# which you can create via Sequel.sqlite_json_op:
+#
+#   j = Sequel.sqlite_json_op(:json_column)
+#
+# Also, on most Sequel expression objects, you can call the sqlite_json_op method
+# to create a Sequel::SQLite::JSONOp object:
+#
+#   j = Sequel[:json_column].sqlite_json_op
+#
+# If you have loaded the {core_extensions extension}[rdoc-ref:doc/core_extensions.rdoc],
+# or you have loaded the core_refinements extension
+# and have activated refinements for the file, you can also use Symbol#sqlite_json_op:
+#
+#   j = :json_column.sqlite_json_op
+#
+# The following methods are available for Sequel::SQLite::JSONOp instances:
+#
+#   j[1]                     # (json_column ->> 1)
+#   j.get(1)                 # (json_column ->> 1)
+#   j.get_text(1)            # (json_column -> 1)
+#   j.extract('$.a')         # json_extract(json_column, '$.a')
+#
+#   j.array_length           # json_array_length(json_column)
+#   j.type                   # json_type(json_column)
+#   j.valid                  # json_valid(json_column)
+#   j.json                   # json(json_column)
+#
+#   j.insert('$.a', 1)       # json_insert(json_column, '$.a', 1)
+#   j.set('$.a', 1)          # json_set(json_column, '$.a', 1)
+#   j.replace('$.a', 1)      # json_replace(json_column, '$.a', 1)
+#   j.remove('$.a')          # json_remove(json_column, '$.a')
+#   j.patch('{"a":2}')       # json_patch(json_column, '{"a":2}')
+#
+#   j.each                   # json_each(json_column)
+#   j.tree                   # json_tree(json_column)
+#
+# Related modules: Sequel::SQLite::JSONOp
+
+#
+module Sequel
+  module SQLite
+    # The JSONOp class is a simple container for a single object that
+    # defines methods that yield Sequel expression objects representing
+    # SQLite json operators and functions.
+    #
+    # In the method documentation examples, assume that:
+    #
+    #   json_op = Sequel.sqlite_json_op(:json)
+    class JSONOp < Sequel::SQL::Wrapper
+      GET = ["(".freeze, " ->> ".freeze, ")".freeze].freeze
+      private_constant :GET
+
+      GET_JSON = ["(".freeze, " -> ".freeze, ")".freeze].freeze
+      private_constant :GET_JSON
+
+      # Returns an expression for getting the JSON array element or object field
+      # at the specified path as a SQLite value.
+      #
+      #   json_op[1]         # (json ->> 1)
+      #   json_op['a']       # (json ->> 'a')
+      #   json_op['$.a.b']   # (json ->> '$.a.b')
+      #   json_op['$[1][2]'] # (json ->> '$[1][2]')
+      def [](key)
+        json_op(GET, key)
+      end
+      alias get []
+
+      # Returns an expression for the length of the JSON array, or the JSON array at
+      # the given path.
+      #
+      #   json_op.array_length         # json_array_length(json)
+      #   json_op.array_length('$[1]') # json_array_length(json, '$[1]')
+      def array_length(*args)
+        Sequel::SQL::NumericExpression.new(:NOOP, function(:array_length, *args))
+      end
+
+      # Returns an expression for a set of information extracted from the top-level
+      # members of the JSON array or object, or the top-level members of the JSON array
+      # or object at the given path.
+      #
+      #   json_op.each        # json_each(json)
+      #   json_op.each('$.a') # json_each(json, '$.a')
+      def each(*args)
+        function(:each, *args)
+      end
+
+      # Returns an expression for the JSON array element or object field at the specified
+      # path as a SQLite value, but only accept paths as arguments, and allow the use of
+      # multiple paths.
+      #
+      #   json_op.extract('$.a')        # json_extract(json, '$.a')
+      #   json_op.extract('$.a', '$.b') # json_extract(json, '$.a', '$.b')
+      def extract(*a)
+        function(:extract, *a)
+      end
+
+      # Returns an expression for getting the JSON array element or object field at the
+      # specified path as a JSON value.
+      #
+      #   json_op.get_json(1)         # (json -> 1)
+      #   json_op.get_json('a')       # (json -> 'a')
+      #   json_op.get_json('$.a.b')   # (json -> '$.a.b')
+      #   json_op.get_json('$[1][2]') # (json -> '$[1][2]')
+      def get_json(key)
+        self.class.new(json_op(GET_JSON, key))
+      end
+
+      # Returns an expression for creating new entries at the given paths in the JSON array
+      # or object, but not overwriting existing entries.
+      #
+      #   json_op.insert('$.a', 1)           # json_insert(json, '$.a', 1)
+      #   json_op.insert('$.a', 1, '$.b', 2) # json_insert(json, '$.a', 1, '$.b', 2)
+      def insert(path, value, *args)
+        wrapped_function(:insert, path, value, *args)
+      end
+
+      # Returns an expression for a minified version of the JSON.
+      #
+      #   json_op.json   # json(json)
+      def json
+        self.class.new(SQL::Function.new(:json, self))
+      end
+      alias minify json
+
+      # Returns an expression for updating the JSON object using the RFC 7396 MergePatch algorithm
+      #
+      #   json_op.patch('{"a": 1, "b": null}') # json_patch(json, '{"a": 1, "b": null}')
+      def patch(json_patch)
+        wrapped_function(:patch, json_patch)
+      end
+
+      # Returns an expression for removing entries at the given paths from the JSON array or object.
+      #
+      #   json_op.remove('$.a')        # json_remove(json, '$.a')
+      #   json_op.remove('$.a', '$.b') # json_remove(json, '$.a', '$.b')
+      def remove(path, *paths)
+        wrapped_function(:remove, path, *paths)
+      end
+
+      # Returns an expression for replacing entries at the given paths in the JSON array or object,
+      # but not creating new entries.
+      #
+      #   json_op.replace('$.a', 1)           # json_replace(json, '$.a', 1)
+      #   json_op.replace('$.a', 1, '$.b', 2) # json_replace(json, '$.a', 1, '$.b', 2)
+      def replace(path, value, *args)
+        wrapped_function(:replace, path, value, *args)
+      end
+
+      # Returns an expression for creating or replacing entries at the given paths in the
+      # JSON array or object.
+      #
+      #   json_op.set('$.a', 1)           # json_set(json, '$.a', 1)
+      #   json_op.set('$.a', 1, '$.b', 2) # json_set(json, '$.a', 1, '$.b', 2)
+      def set(path, value, *args)
+        wrapped_function(:set, path, value, *args)
+      end
+
+      # Returns an expression for a set of information extracted from the JSON array or object, or
+      # the JSON array or object at the given path.
+      #
+      #   json_op.tree        # json_tree(json)
+      #   json_op.tree('$.a') # json_tree(json, '$.a')
+      def tree(*args)
+        function(:tree, *args)
+      end
+
+      # Returns an expression for the type of the JSON value or the JSON value at the given path.
+      #
+      #   json_op.type         # json_type(json)
+      #   json_op.type('$[1]') # json_type(json, '$[1]')
+      def type(*args)
+        Sequel::SQL::StringExpression.new(:NOOP, function(:type, *args))
+      end
+      alias typeof type
+
+      # Returns a boolean expression for whether the JSON is valid or not.
+      def valid
+        Sequel::SQL::BooleanExpression.new(:NOOP, function(:valid))
+      end
+
+      private
+
+      # Internals of the [], get, get_json methods, using a placeholder literal string.
+      def json_op(str, args)
+        self.class.new(Sequel::SQL::PlaceholderLiteralString.new(str, [self, args]))
+      end
+
+      # Internals of the methods that return functions prefixed with +json_+.
+      def function(name, *args)
+        SQL::Function.new("json_#{name}", self, *args)
+      end
+
+      # Internals of the methods that return functions prefixed with +json_+, that
+      # return JSON values.
+      def wrapped_function(*args)
+        self.class.new(function(*args))
+      end
+    end
+
+    module JSONOpMethods
+      # Wrap the receiver in an JSONOp so you can easily use the SQLite
+      # json functions and operators with it.
+      def sqlite_json_op
+        JSONOp.new(self)
+      end
+    end
+  end
+
+  module SQL::Builders
+    # Return the object wrapped in an SQLite::JSONOp.
+    def sqlite_json_op(v)
+      case v
+      when SQLite::JSONOp
+        v
+      else
+        SQLite::JSONOp.new(v)
+      end
+    end
+  end
+
+  class SQL::GenericExpression
+    include Sequel::SQLite::JSONOpMethods
+  end
+
+  class LiteralString
+    include Sequel::SQLite::JSONOpMethods
+  end
+end
+
+# :nocov:
+if Sequel.core_extensions?
+  class Symbol
+    include Sequel::SQLite::JSONOpMethods
+  end
+end
+
+if defined?(Sequel::CoreRefinements)
+  module Sequel::CoreRefinements
+    refine Symbol do
+      send INCLUDE_METH, Sequel::SQLite::JSONOpMethods
+    end
+  end
+end
+# :nocov:

data/lib/sequel/extensions/string_date_time.rb

@@ -4,6 +4,10 @@
 # for converting the strings to a date (e.g. String#to_date), allowing
 # for backwards compatibility with legacy Sequel code.
 #
+# These methods calls +parse+ on the related class, and as such, can
+# result in denial of service in older versions of Ruby for large
+# untrusted input, and raise exceptions in newer versions of Ruby. 
+#
 # To load the extension:
 #
 #   Sequel.extension :string_date_time
@@ -11,42 +15,34 @@
 class String
   # Converts a string into a Date object.
   def to_date
-    begin
-      Date.parse(self, Sequel.convert_two_digit_years)
-    rescue => e
-      raise Sequel.convert_exception_class(e, Sequel::InvalidValue)
-    end
+    Date.parse(self, Sequel.convert_two_digit_years)
+  rescue => e
+    raise Sequel.convert_exception_class(e, Sequel::InvalidValue)
   end
 
   # Converts a string into a DateTime object.
   def to_datetime
-    begin
-      DateTime.parse(self, Sequel.convert_two_digit_years)
-    rescue => e
-      raise Sequel.convert_exception_class(e, Sequel::InvalidValue)
-    end
+    DateTime.parse(self, Sequel.convert_two_digit_years)
+  rescue => e
+    raise Sequel.convert_exception_class(e, Sequel::InvalidValue)
   end
 
   # Converts a string into a Time or DateTime object, depending on the
   # value of Sequel.datetime_class
   def to_sequel_time
-    begin
-      if Sequel.datetime_class == DateTime
-        DateTime.parse(self, Sequel.convert_two_digit_years)
-      else
-        Sequel.datetime_class.parse(self)
-      end
-    rescue => e
-      raise Sequel.convert_exception_class(e, Sequel::InvalidValue)
+    if Sequel.datetime_class == DateTime
+      DateTime.parse(self, Sequel.convert_two_digit_years)
+    else
+      Sequel.datetime_class.parse(self)
     end
+  rescue => e
+    raise Sequel.convert_exception_class(e, Sequel::InvalidValue)
   end
 
   # Converts a string into a Time object.
   def to_time
-    begin
-      Time.parse(self)
-    rescue => e
-      raise Sequel.convert_exception_class(e, Sequel::InvalidValue)
-    end
+    Time.parse(self)
+  rescue => e
+    raise Sequel.convert_exception_class(e, Sequel::InvalidValue)
   end
 end

data/lib/sequel/model/base.rb

@@ -682,13 +682,11 @@ module Sequel
       
       # Yield to the passed block and if do_raise is false, swallow all errors other than DatabaseConnectionErrors.
       def check_non_connection_error(do_raise=require_valid_table)
-        begin
-          db.transaction(:savepoint=>:only){yield}
-        rescue Sequel::DatabaseConnectionError
-          raise
-        rescue Sequel::Error
-          raise if do_raise
-        end
+        db.transaction(:savepoint=>:only){yield}
+      rescue Sequel::DatabaseConnectionError
+        raise
+      rescue Sequel::Error
+        raise if do_raise
       end
 
       # Convert the given object to a Dataset that should be used as
@@ -1630,11 +1628,9 @@ module Sequel
       #   artist.set(name: 'Invalid').valid? # => false
       #   artist.errors.full_messages # => ['name cannot be Invalid']
       def valid?(opts = OPTS)
-        begin
-          _valid?(opts)
-        rescue HookFailed
-          false
-        end
+        _valid?(opts)
+      rescue HookFailed
+        false
       end
 
       private

data/lib/sequel/plugins/auto_restrict_eager_graph.rb

@@ -0,0 +1,62 @@
+# frozen-string-literal: true
+
+module Sequel
+  module Plugins
+    # The auto_restrict_eager_graph plugin will automatically disallow the use
+    # of eager_graph for associations that have associated blocks but no :graph_*
+    # association options.  The reason for this is the block will have an effect
+    # during regular and eager loading, but not loading via eager_graph, and it
+    # is likely that whatever the block is doing should have an equivalent done
+    # when eager_graphing.  Most likely, not including a :graph_* option was either
+    # an oversight (and one should be added), or use with eager_graph was never
+    # intended (and usage should be forbidden).  Disallowing eager_graph in this
+    # case prevents likely unexpected behavior during eager_graph.
+    #
+    # As an example of this, consider the following code:
+    #
+    #   Album.one_to_many :popular_tracks, class: :Track do |ds|
+    #     ds = ds.where(popular: true)
+    #   end  
+    #
+    #   Album.eager(:popular_tracks).all
+    #   # SELECT * FROM albums
+    #   # SELECT * FROM tracks WHERE ((popular IS TRUE) AND (album_id IN (...)))
+    #
+    #   # Notice that no condition for tracks.popular is added.
+    #   Album.eager_graph(:popular_tracks).all
+    #   # SELECT ... FROM albums LEFT JOIN tracks ON (tracks.album_id = albums.id)
+    #   
+    # With the auto_restrict_eager_graph plugin, the eager_graph call above will
+    # raise an error, alerting you to the fact that you either should not be
+    # using eager_graph with the association, or that you should be adding an
+    # appropriate :graph_* option, such as:
+    #
+    #   Album.one_to_many :popular_tracks, class: :Track, graph_conditions: {popular: true} do |ds|
+    #     ds = ds.where(popular: true)
+    #   end  
+    #
+    # Usage:
+    #
+    #   # Automatically restrict eager_graph for associations if appropriate for all
+    #   # model subclasses (called before loading subclasses)
+    #   Sequel::Model.plugin :auto_restrict_eager_graph
+    #
+    #   # Automatically restrict eager_graph for associations in Album class
+    #   Album.plugin :auto_restrict_eager_graph
+    module AutoRestrictEagerGraph
+      module ClassMethods
+        # When defining an association, if a block is given for the association, but
+        # a :graph_* option is not used, disallow the use of eager_graph.
+        def associate(type, name, opts = OPTS, &block)
+          opts = super
+
+          if opts[:block] && !opts.has_key?(:allow_eager_graph) && !opts[:orig_opts].any?{|k,| /\Agraph_/ =~ k}
+            opts[:allow_eager_graph] = false
+          end
+
+          opts
+        end
+      end
+    end
+  end
+end

data/lib/sequel/plugins/column_encryption.rb

@@ -356,7 +356,7 @@ module Sequel
 
         # Keys should be an array of arrays containing key_id, key string, auth_data, and padding.
         def initialize(keys)
-          if keys.empty?
+          if !keys || keys.empty?
             raise Error, "Cannot initialize encryptor without encryption key"
           end
 

data/lib/sequel/plugins/enum.rb

@@ -0,0 +1,124 @@
+# frozen-string-literal: true
+
+module Sequel
+  module Plugins
+    # The enum plugin allows for easily adding methods to modify the value of
+    # a column.  It allows treating the column itself as an enum, returning a
+    # symbol for the related enum value.  It also allows for setting up dataset
+    # methods to easily find records having or not having each enum value.
+    #
+    # After loading the plugin, you can call the +enum+ method to define the
+    # methods.  The +enum+ method accepts a symbol for the underlying
+    # database column, and a hash with symbol keys for the enum values.
+    # For example, the following call:
+    #
+    #   Album.enum :status_id, good: 1, bad: 2
+    #
+    # Will define the following instance methods:
+    #
+    # Album#good! :: Change +status_id+ to +1+ (does not save the receiver)
+    # Album#bad! :: Change +status_id+ to +2+ (does not save the receiver)
+    # Album#good? :: Return whether +status_id+ is +1+
+    # Album#bad? :: Return whether +status_id+ is +2+
+    #
+    # It will override the following instance methods:
+    #
+    # Album#status_id :: Return +:good+/+:bad+ instead of +1+/+2+ (other values returned as-is)
+    # Album#status_id= :: Allow calling with +:good+/+:bad+ to set +status_id+ to +1+/+2+ (other values,
+    #                     such as <tt>'good'</tt>/<tt>'bad'</tt> set as-is)
+    #
+    # If will define the following dataset methods:
+    #
+    # Album.dataset.good :: Return a dataset filtered to rows where +status_id+ is +1+
+    # Album.dataset.not_good :: Return a dataset filtered to rows where +status_id+ is not +1+
+    # Album.dataset.bad:: Return a dataset filtered to rows where +status_id+ is +2+
+    # Album.dataset.not_bad:: Return a dataset filtered to rows where +status_id+ is not +2+
+    #
+    # When calling +enum+, you can also provide the following options:
+    #
+    # :prefix :: Use a prefix for methods defined for each enum value. If +true+ is provided at the value, use the column name as the prefix.
+    #            For example, with <tt>prefix: 'status'</tt>, the instance methods defined above would be +status_good?+, +status_bad?+,
+    #            +status_good!+, and +status_bad!+, and the dataset methods defined would be +status_good+, +status_not_good+, +status_bad+,
+    #            and +status_not_bad+.
+    # :suffix :: Use a suffix for methods defined for each enum value. If +true+ is provided at the value, use the column name as the suffix.
+    #            For example, with <tt>suffix: 'status'</tt>, the instance methods defined above would be +good_status?+, +bad_status?+,
+    #            +good_status!+, and +bad_status!+, and the dataset methods defined would be +good_status+, +not_good_status+, +bad_status+,
+    #            and +not_bad_status+.
+    # :override_accessors :: Set to +false+ to not override the column accessor methods.
+    # :dataset_methods :: Set to +false+ to not define dataset methods.
+    #
+    # Note that this does not use a true enum column in the database.  If you are
+    # looking for enum support in the database, and your are using PostgreSQL,
+    # Sequel supports that via the pg_enum Database extension.
+    #
+    # Usage:
+    #
+    #   # Make all model subclasses handle enums
+    #   Sequel::Model.plugin :enum
+    #
+    #   # Make the Album class handle enums
+    #   Album.plugin :enum
+    module Enum
+      module ClassMethods
+        # Define instance and dataset methods in this class to treat column
+        # as a enum.  See Enum documentation for usage.
+        def enum(column, values, opts=OPTS)
+          raise Sequel::Error, "enum column must be a symbol" unless column.is_a?(Symbol)
+          raise Sequel::Error, "enum values must be provided as a hash with symbol keys" unless values.is_a?(Hash) && values.all?{|k,| k.is_a?(Symbol)}
+
+          if prefix = opts[:prefix]
+            prefix = column if prefix == true
+            prefix = "#{prefix}_"
+          end
+
+          if suffix = opts[:suffix]
+            suffix = column if suffix == true
+            suffix = "_#{suffix}"
+          end
+          
+          values = Hash[values].freeze
+          inverted = values.invert.freeze
+
+          unless @enum_methods
+            @enum_methods = Module.new
+            include @enum_methods
+          end
+
+          @enum_methods.module_eval do
+            unless opts[:override_accessors] == false
+              define_method(column) do
+                v = super()
+                inverted.fetch(v, v)
+              end
+
+              define_method(:"#{column}=") do |v|
+                super(values.fetch(v, v))
+              end
+            end
+
+            values.each do |key, value|
+              define_method(:"#{prefix}#{key}#{suffix}!") do
+                self[column] = value
+                nil
+              end
+
+              define_method(:"#{prefix}#{key}#{suffix}?") do
+                self[column] == value
+              end
+            end
+          end
+
+          unless opts[:dataset_methods] == false
+            dataset_module do
+              values.each do |key, value|
+                cond = Sequel[column=>value]
+                where :"#{prefix}#{key}#{suffix}", cond
+                where :"#{prefix}not_#{key}#{suffix}", ~cond
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/sequel/plugins/instance_specific_default.rb

@@ -29,7 +29,7 @@ module Sequel
     #   end
     #
     # +first_track+ is not instance specific, but +last_track+ and +recent_tracks+ are.
-    # +last_trac+ is because the +num_tracks+ call in the block is calling
+    # +last_track+ is because the +num_tracks+ call in the block is calling
     # <tt>Album#num_tracks</tt>.  +recent_tracks+ is because the value will change over
     # time. This plugin allows you to find these cases, and set the :instance_specific
     # option appropriately for them: