@bakery-framework/orm 2.0.0-alpha.5 → 2.0.0-alpha.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bakery-framework/orm",
-  "version": "2.0.0-alpha.5",
+  "version": "2.0.0-alpha.7",
   "description": "Bakery database layer: adapters, query builder, schema sync and backup.",
   "keywords": [
     "bakery",
@@ -54,6 +54,6 @@
     "bun": ">=1.3.14"
   },
   "dependencies": {
-    "@bakery-framework/core": "^2.0.0-alpha.5"
+    "@bakery-framework/core": "^2.0.0-alpha.7"
   }
 }

package/src/adapters/base.ts

@@ -849,20 +849,69 @@ export abstract class SQLAdapter {
     return new DatabaseStatement(this, sqlText)
   }
 
+  /**
+   * The `LIKE` escape character — `!`, and deliberately **not** a backslash.
+   *
+   * A backslash is the obvious choice and is unusable here. MySQL processes
+   * backslash escapes inside string literals where SQLite and Postgres do not,
+   * so the clause would need to differ per dialect; and worse, Postgres never
+   * receives what is written. `normalizePostgresSQL` treats `\'` as an escaped
+   * quote — MySQL's rule, applied to every dialect — so `ESCAPE '\'` leaves the
+   * string literal *open*, swallows the rest of the statement, and the driver
+   * reports `syntax error at or near "OFFSET"` from a clause several tokens
+   * later.
+   *
+   * That normalizer behaviour is a real defect and is not fixed here: a test
+   * pins it (`a backslash escape keeps the character it escapes`), and changing
+   * it would change every literal the framework emits. Choosing a character
+   * with no meaning to any of the three parsers sidesteps it entirely, and one
+   * spelling for all dialects beats a capability getter per dialect.
+   */
+  protected readonly likeEscape = '!'
+
+  get likeEscapeClause(): string {
+    return ` ESCAPE '${this.likeEscape}'`
+  }
+
+  /**
+   * Make a value match literally under `LIKE`.
+   *
+   * Without this a search for `50%` matches every row and one for `a_b` matches
+   * `axb` — `%` and `_` are the wildcards, and the filter passed user input
+   * through untouched. The escape character itself goes first, or escaping it
+   * afterwards would double the ones this method just added.
+   */
+  protected escapeLike(value: string): string {
+    const e = this.likeEscape
+    return value
+      .split(e)
+      .join(e + e)
+      .replace(/[%_]/g, m => `${e}${m}`)
+  }
+
+  /**
+   * `WHERE` and `ORDER BY` for a browsable table listing.
+   *
+   * A filter is either a **bare scalar**, which means `contains` and is what
+   * every caller sent before operators existed, or **`{op, value}`**. Keeping
+   * the scalar form meaningful is not politeness: `getData` is public and the
+   * dashboard still calls it that way.
+   *
+   * Columns are intersected with the real column set by the caller, so an
+   * unknown column disappears rather than reaching SQL. Values always bind.
+   */
   protected buildFilterSort(
     options: SQLAdapter.FilterSortOptions,
     validCols: Set<string>,
   ) {
     const whereParams: unknown[] = []
-    const whereClauses = Object.entries(options.filters || {})
-      .filter(
-        ([col, val]) =>
-          validCols.has(col) && val !== undefined && val !== null && val !== '',
-      )
-      .map(([col, val]) => {
-        whereParams.push(`%${val}%`)
-        return `${this.quote(col)} LIKE ?`
-      })
+    const whereClauses: string[] = []
+
+    for (const [col, raw] of Object.entries(options.filters || {})) {
+      if (!validCols.has(col)) continue
+      const clause = this.filterClause(col, raw, whereParams)
+      if (clause) whereClauses.push(clause)
+    }
 
     const whereSql = whereClauses.length
       ? ` WHERE ${whereClauses.join(' AND ')}`
@@ -880,6 +929,67 @@ export abstract class SQLAdapter {
     return { whereSql, orderSql, whereParams }
   }
 
+  /**
+   * One filter, as SQL. Returns `null` when the filter says nothing.
+   *
+   * `params` is appended to rather than returned, because an operator may bind
+   * one value, two, or none at all — `IS NULL` has nothing to bind, and
+   * pretending otherwise is how a placeholder count drifts from its arguments.
+   */
+  private filterClause(
+    col: string,
+    raw: unknown,
+    params: unknown[],
+  ): string | null {
+    const quoted = this.quote(col)
+
+    // The pre-operator form. An empty string means "no filter" here, which is
+    // what a cleared text box sends and what every caller has relied on.
+    if (raw === null || raw === undefined || typeof raw !== 'object') {
+      if (raw === undefined || raw === null || raw === '') return null
+      params.push(`%${this.escapeLike(String(raw))}%`)
+      return `${quoted} LIKE ?${this.likeEscapeClause}`
+    }
+
+    const { op, value } = raw as { op?: string; value?: unknown }
+
+    // No value to bind, and none expected — these two are the whole reason a
+    // filter cannot be modelled as a plain column/value pair.
+    if (op === 'null') return `${quoted} IS NULL`
+    if (op === 'notnull') return `${quoted} IS NOT NULL`
+
+    if (value === undefined || value === null) return null
+
+    const comparison: Record<string, string> = {
+      eq: '=',
+      ne: '<>',
+      gt: '>',
+      gte: '>=',
+      lt: '<',
+      lte: '<=',
+    }
+    if (op && comparison[op]) {
+      params.push(value)
+      return `${quoted} ${comparison[op]} ?`
+    }
+
+    const pattern: Record<string, (v: string) => string> = {
+      contains: v => `%${v}%`,
+      starts: v => `${v}%`,
+      ends: v => `%${v}`,
+    }
+    const shape = op ? pattern[op] : undefined
+    if (shape) {
+      params.push(shape(this.escapeLike(String(value))))
+      return `${quoted} LIKE ?${this.likeEscapeClause}`
+    }
+
+    // An operator this dialect does not know is dropped rather than guessed
+    // at. Guessing would mean answering a question nobody asked, and the
+    // caller validates the vocabulary before it gets here.
+    return null
+  }
+
   protected formatDefault(
     def: unknown,
     boolTrue: string,

package/src/adapters/pgsql.ts

@@ -253,50 +253,62 @@ export class PGAdapter extends SQLAdapter {
         " WHERE table_schema NOT IN ('pg_catalog', 'information_schema')" +
         ' ORDER BY table_name',
     ).all()) as any[]
-    const tablesWithDetails: SQLAdapter.TableDetails[] = []
-
-    for (const t of res) {
-      const qName = this.quote(t.name)
-      const [countRes, cols, pkCols, idxs] = (await Promise.all([
-        this.query(`SELECT COUNT(*)::int as count FROM ${qName}`).get(),
-        this.query(
-          'SELECT column_name AS name, data_type AS type,' +
-            ' is_nullable AS is_nullable' +
-            ' FROM information_schema.columns' +
-            ' WHERE table_name = ?' +
-            " AND table_schema NOT IN ('pg_catalog', 'information_schema')" +
-            ' ORDER BY ordinal_position',
-        ).all(t.name),
-        this.query(
-          'SELECT a.attname AS name' +
-            ' FROM pg_index i' +
-            ' JOIN pg_attribute a ON a.attrelid = i.indrelid' +
-            ' AND a.attnum = ANY(i.indkey)' +
-            ` WHERE i.indisprimary AND i.indrelid = ${qName}::regclass`,
-        ).all(),
-        this.query(
-          'SELECT indexname AS name, indexdef AS def' +
-            ' FROM pg_indexes' +
-            " WHERE schemaname NOT IN ('pg_catalog', 'information_schema')" +
-            ' AND tablename = ?',
-        ).all(t.name),
-      ])) as [SQLAdapter.CountRow, any[], any[], any[]]
-      tablesWithDetails.push({
-        name: t.name,
-        rowCount: countRes?.count || 0,
-        columns: cols.map(c => ({
-          name: c.name,
-          type: c.type,
-          notnull: c.is_nullable === 'NO',
-          pk: pkCols.some(pk => pk.name === c.name),
-        })),
-        indexes: idxs.map(i => ({
-          name: i.name,
-          unique: /UNIQUE/i.test(i.def),
-        })),
-      })
-    }
-    return tablesWithDetails
+    // One wave rather than N. The four queries per table were already
+    // concurrent; the loop around them awaited each table in turn, so a
+    // 20-table schema cost 20 sequential round-trip waves. See the note in
+    // sqlite.ts about the COUNT(*), which is a full scan here too.
+    return await Promise.all(
+      res.map(async t => {
+        const qName = this.quote(t.name)
+        const [countRes, cols, pkCols, idxs] = (await Promise.all([
+          this.query(`SELECT COUNT(*)::int as count FROM ${qName}`).get(),
+          this.query(
+            'SELECT column_name AS name, data_type AS type,' +
+              ' is_nullable AS is_nullable' +
+              ' FROM information_schema.columns' +
+              ' WHERE table_name = ?' +
+              " AND table_schema NOT IN ('pg_catalog', 'information_schema')" +
+              ' ORDER BY ordinal_position',
+          ).all(t.name),
+          // `::regclass` casts a **string**, so the table name binds as a
+          // parameter. It used to interpolate `qName` — a double-quoted
+          // *identifier* — which Postgres reads as a column reference, so this
+          // threw `column "<table>" does not exist` for every table and took the
+          // whole of `getSchema()` down with it on this dialect.
+          //
+          // The quiet case was worse than the loud one: a table with a column of
+          // the same name resolved, casting that column's *value* to a regclass
+          // and reporting some other table's primary key as this one's.
+          this.query(
+            'SELECT a.attname AS name' +
+              ' FROM pg_index i' +
+              ' JOIN pg_attribute a ON a.attrelid = i.indrelid' +
+              ' AND a.attnum = ANY(i.indkey)' +
+              ' WHERE i.indisprimary AND i.indrelid = ?::regclass',
+          ).all(t.name),
+          this.query(
+            'SELECT indexname AS name, indexdef AS def' +
+              ' FROM pg_indexes' +
+              " WHERE schemaname NOT IN ('pg_catalog', 'information_schema')" +
+              ' AND tablename = ?',
+          ).all(t.name),
+        ])) as [SQLAdapter.CountRow, any[], any[], any[]]
+        return {
+          name: t.name,
+          rowCount: countRes?.count || 0,
+          columns: cols.map(c => ({
+            name: c.name,
+            type: c.type,
+            notnull: c.is_nullable === 'NO',
+            pk: pkCols.some(pk => pk.name === c.name),
+          })),
+          indexes: idxs.map(i => ({
+            name: i.name,
+            unique: /UNIQUE/i.test(i.def),
+          })),
+        }
+      }),
+    )
   }
 
   async getData(

package/src/adapters/sqlite.ts

@@ -287,29 +287,50 @@ export class SQLiteAdapter extends SQLAdapter {
       'SELECT name FROM sqlite_master' +
         " WHERE type='table' AND name NOT LIKE 'sqlite_%'",
     ).all()) as SQLAdapter.NameRow[]
-    const tablesWithDetails: SQLAdapter.TableDetails[] = []
-    for (const t of res) {
-      const tableName = this.quote(t.name)
-
-      const [countRes, cols, idxs] = (await Promise.all([
-        this.query(`SELECT COUNT(*) as count FROM ${tableName}`).get(),
-        this.query(`PRAGMA table_info(${tableName})`).all(),
-        this.query(`PRAGMA index_list(${tableName})`).all(),
-      ])) as [SQLAdapter.CountRow, any[], any[]]
-
-      tablesWithDetails.push({
-        name: t.name,
-        rowCount: countRes?.count || 0,
-        columns: cols.map(c => ({
-          name: c.name,
-          type: c.type,
-          notnull: c.notnull === 1,
-          pk: c.pk === 1,
-        })),
-        indexes: idxs.map(i => ({ name: i.name, unique: i.unique === 1 })),
-      })
-    }
-    return tablesWithDetails
+    // Per table rather than per wave: the three queries below were already
+    // concurrent, but the loop around them awaited each table in turn, so a
+    // 20-table schema cost 20 sequential round-trip waves. They share nothing,
+    // so the whole fan-out is one wave now.
+    //
+    // Worth knowing before this grows: the `COUNT(*)` is a full scan on this
+    // dialect and on Postgres, and it is paid on every caller of `getSchema()`
+    // even though only a schema *listing* displays the number. Making it
+    // optional means `rowCount` has to admit it can be absent, which is a type
+    // change across every consumer — recorded rather than done here.
+    return await Promise.all(
+      res.map(async t => {
+        const tableName = this.quote(t.name)
+
+        const [countRes, cols, idxs] = (await Promise.all([
+          this.query(`SELECT COUNT(*) as count FROM ${tableName}`).get(),
+          this.query(`PRAGMA table_info(${tableName})`).all(),
+          this.query(`PRAGMA index_list(${tableName})`).all(),
+        ])) as [SQLAdapter.CountRow, any[], any[]]
+
+        return {
+          name: t.name,
+          rowCount: countRes?.count || 0,
+          columns: cols.map(c => ({
+            name: c.name,
+            type: c.type,
+            notnull: c.notnull === 1,
+            // `pk` is the column's **1-based position within the primary key**,
+            // not a boolean — `PRAGMA table_info` reports 0 for "not part of the
+            // key", 1 for the first key column, 2 for the second. So `=== 1`
+            // reported a composite `PRIMARY KEY (a, b)` as a single-column key on
+            // `a`, silently, and only on SQLite: MySQL reads `column_key = 'PRI'`
+            // and Postgres reads `pg_index.indisprimary`, both of which are set on
+            // every member.
+            //
+            // `parseConstraints` a few hundred lines down already had this right
+            // (`col.pk > 0`), which is why `getConstraints()` disagreed with
+            // `getSchema()` about the same table.
+            pk: c.pk > 0,
+          })),
+          indexes: idxs.map(i => ({ name: i.name, unique: i.unique === 1 })),
+        }
+      }),
+    )
   }
 
   async getData(