@capgo/capacitor-fast-sql 8.2.18 → 8.3.1

package/ios/Sources/CapgoCapacitorFastSqlPlugin/BinaryFrame.swift

@@ -0,0 +1,95 @@
+import Foundation
+import CoreFoundation
+
+enum BinaryFrameError: Error {
+    case invalid
+    case limit
+}
+
+/// Version 1 envelope shared with Android and JavaScript. Data stays binary.
+enum BinaryFrame {
+    static let contentType = "application/vnd.capgo.fast-sql.v1+binary"
+    static let maxBytes = 64 * 1024 * 1024
+    private static let maxMetadata = 1024 * 1024
+    private static let headerBytes = 12
+    private static let magic: [UInt8] = [70, 83, 81, 49]
+
+    static func encode(_ value: Any) throws -> Data {
+        var attachments = Data()
+        var nodes = 0
+        var blobs = 0
+        func encodeValue(_ value: Any, depth: Int) throws -> Any {
+            nodes += 1
+            guard nodes <= 100000, depth <= 32 else { throw BinaryFrameError.limit }
+            if let bytes = value as? Data {
+                blobs += 1
+                guard blobs <= 4096, attachments.count + bytes.count <= maxBytes - headerBytes else { throw BinaryFrameError.limit }
+                let reference = ["$blob": [attachments.count, bytes.count]]
+                attachments.append(bytes)
+                return reference
+            }
+            if let number = value as? NSNumber, !number.doubleValue.isFinite { throw BinaryFrameError.invalid }
+            if let array = value as? [Any] { return try array.map { try encodeValue($0, depth: depth + 1) } }
+            if let object = value as? [String: Any] {
+                return try object.mapValues { try encodeValue($0, depth: depth + 1) }
+            }
+            return value
+        }
+        let metadata = try JSONSerialization.data(withJSONObject: encodeValue(value, depth: 0), options: [.fragmentsAllowed])
+        guard metadata.count <= maxMetadata, headerBytes + metadata.count + attachments.count <= maxBytes else { throw BinaryFrameError.limit }
+        var output = Data(magic)
+        for count in [metadata.count, attachments.count] {
+            var littleEndian = UInt32(count).littleEndian
+            withUnsafeBytes(of: &littleEndian) { output.append(contentsOf: $0) }
+        }
+        output.append(metadata)
+        output.append(attachments)
+        return output
+    }
+
+    static func decode(_ frame: Data) throws -> Any {
+        guard frame.count >= headerBytes, frame.count <= maxBytes, Array(frame.prefix(4)) == magic else { throw BinaryFrameError.invalid }
+        let metadataLength = frame.withUnsafeBytes { Int(UInt32(littleEndian: $0.loadUnaligned(fromByteOffset: 4, as: UInt32.self))) }
+        let payloadLength = frame.withUnsafeBytes { Int(UInt32(littleEndian: $0.loadUnaligned(fromByteOffset: 8, as: UInt32.self))) }
+        let payloadOffset = headerBytes + metadataLength
+        guard metadataLength > 0, metadataLength <= maxMetadata, payloadOffset + payloadLength == frame.count else { throw BinaryFrameError.invalid }
+        let start = frame.startIndex
+        let metadata = frame.subdata(in: (start + headerBytes)..<(start + payloadOffset))
+        guard String(data: metadata, encoding: .utf8) != nil else { throw BinaryFrameError.invalid }
+        var nesting = 0
+        var quoted = false
+        var escaped = false
+        for byte in metadata {
+            if quoted {
+                if escaped { escaped = false } else if byte == 92 { escaped = true } else if byte == 34 { quoted = false }
+            } else if byte == 34 { quoted = true } else if byte == 91 || byte == 123 {
+                nesting += 1
+                guard nesting <= 33 else { throw BinaryFrameError.limit }
+            } else if byte == 93 || byte == 125 { nesting -= 1 }
+        }
+        guard let value = try? JSONSerialization.jsonObject(with: metadata, options: [.fragmentsAllowed]) else { throw BinaryFrameError.invalid }
+        var nodes = 0
+        var blobs = 0
+        var referencedBytes = 0
+        func decodeValue(_ value: Any, depth: Int) throws -> Any {
+            nodes += 1
+            guard nodes <= 100000, depth <= 32 else { throw BinaryFrameError.limit }
+            if let array = value as? [Any] { return try array.map { try decodeValue($0, depth: depth + 1) } }
+            guard let object = value as? [String: Any] else { return value }
+            if object.count == 1, let raw = object["$blob"] {
+                guard let reference = raw as? [NSNumber], reference.count == 2 else { throw BinaryFrameError.invalid }
+                let offset = reference[0].doubleValue
+                let count = reference[1].doubleValue
+                guard reference.allSatisfy({ CFGetTypeID($0) != CFBooleanGetTypeID() }), offset.isFinite, count.isFinite,
+                      offset >= 0, count >= 0, offset.rounded() == offset, count.rounded() == count,
+                      offset + count <= Double(payloadLength) else { throw BinaryFrameError.invalid }
+                referencedBytes += Int(count)
+                blobs += 1
+                guard blobs <= 4096, referencedBytes <= maxBytes else { throw BinaryFrameError.limit }
+                return frame.subdata(in: (start + payloadOffset + Int(offset))..<(start + payloadOffset + Int(offset) + Int(count)))
+            }
+            return try object.mapValues { try decodeValue($0, depth: depth + 1) }
+        }
+        return try decodeValue(value, depth: 0)
+    }
+}

package/ios/Sources/CapgoCapacitorFastSqlPlugin/CapgoCapacitorFastSqlPlugin.swift

@@ -10,7 +10,7 @@ import SQLite3
  */
 @objc(CapgoCapacitorFastSqlPlugin)
 public class CapgoCapacitorFastSqlPlugin: CAPPlugin, CAPBridgedPlugin {
-    private let pluginVersion: String = "8.2.18"
+    private let pluginVersion: String = "8.3.1"
     public let identifier = "CapgoCapacitorFastSqlPlugin"
     public let jsName = "CapgoCapacitorFastSql"
     public let pluginMethods: [CAPPluginMethod] = [
@@ -53,6 +53,7 @@ public class CapgoCapacitorFastSqlPlugin: CAPPlugin, CAPBridgedPlugin {
                 call.resolve([
                     "port": server.port,
                     "token": server.token,
+                    "binaryProtocolVersion": 1,
                     "database": database
                 ])
                 return
@@ -102,6 +103,7 @@ public class CapgoCapacitorFastSqlPlugin: CAPPlugin, CAPBridgedPlugin {
             call.resolve([
                 "port": server.port,
                 "token": server.token,
+                "binaryProtocolVersion": 1,
                 "database": database
             ])
         } catch {
@@ -151,7 +153,8 @@ public class CapgoCapacitorFastSqlPlugin: CAPPlugin, CAPBridgedPlugin {
 
         call.resolve([
             "port": server.port,
-            "token": server.token
+            "token": server.token,
+            "binaryProtocolVersion": 1
         ])
     }
 
@@ -244,7 +247,8 @@ public class CapgoCapacitorFastSqlPlugin: CAPPlugin, CAPBridgedPlugin {
 
     @objc func getPluginVersion(_ call: CAPPluginCall) {
         call.resolve([
-            "version": pluginVersion
+            "version": pluginVersion,
+            "binaryProtocolVersion": 1
         ])
     }
 

package/ios/Sources/CapgoCapacitorFastSqlPlugin/SQLDatabase.swift

@@ -14,6 +14,7 @@ private let sqliteTransient = unsafeBitCast(-1, to: sqlite3_destructor_type.self
  */
 class SQLDatabase {
     let isReadOnly: Bool
+    private let operationLock = NSRecursiveLock()
     private var db: OpaquePointer?
     private let path: String
     private var inTransaction = false
@@ -86,13 +87,17 @@ class SQLDatabase {
     }
 
     func close() {
+        operationLock.lock()
+        defer { operationLock.unlock() }
         if let db = db {
             sqlite3_close(db)
             self.db = nil
         }
     }
 
-    func execute(statement: String, params: [Any]) throws -> [String: Any] {
+    func execute(statement: String, params: [Any], binaryResults: Bool = false) throws -> [String: Any] {
+        operationLock.lock()
+        defer { operationLock.unlock() }
         guard let db = db else {
             throw SQLError.notOpen
         }
@@ -139,7 +144,7 @@ class SQLDatabase {
                 var row: [String: Any] = [:]
                 for columnIndex in 0..<columnCount {
                     let columnName = columnNames[Int(columnIndex)]
-                    let value = getColumnValue(stmt: stmt, index: columnIndex)
+                    let value = getColumnValue(stmt: stmt, index: columnIndex, binaryResults: binaryResults)
                     row[columnName] = value
                 }
                 rows.append(row)
@@ -163,6 +168,8 @@ class SQLDatabase {
     }
 
     func beginTransaction() throws {
+        operationLock.lock()
+        defer { operationLock.unlock() }
         guard !inTransaction else {
             throw SQLError.transactionAlreadyActive
         }
@@ -171,6 +178,8 @@ class SQLDatabase {
     }
 
     func commitTransaction() throws {
+        operationLock.lock()
+        defer { operationLock.unlock() }
         guard inTransaction else {
             throw SQLError.noTransactionActive
         }
@@ -179,6 +188,8 @@ class SQLDatabase {
     }
 
     func rollbackTransaction() throws {
+        operationLock.lock()
+        defer { operationLock.unlock() }
         guard inTransaction else {
             throw SQLError.noTransactionActive
         }
@@ -197,6 +208,10 @@ class SQLDatabase {
         }
 
         // Handle different types
+        if let data = value as? Data {
+            if data.isEmpty { return sqlite3_bind_zeroblob(stmt, index, 0) }
+            return data.withUnsafeBytes { sqlite3_bind_blob(stmt, index, $0.baseAddress, Int32(data.count), sqliteTransient) }
+        }
         if let str = value as? String {
             return sqlite3_bind_text(stmt, index, str, -1, sqliteTransient)
         } else if let num = value as? NSNumber {
@@ -227,7 +242,7 @@ class SQLDatabase {
         return SQLITE_ERROR
     }
 
-    private func getColumnValue(stmt: OpaquePointer?, index: Int32) -> Any {
+    private func getColumnValue(stmt: OpaquePointer?, index: Int32, binaryResults: Bool) -> Any {
         guard let stmt = stmt else {
             return NSNull()
         }
@@ -246,11 +261,13 @@ class SQLDatabase {
             return NSNull()
         case SQLITE_BLOB:
             if sqlite3_column_bytes(stmt, index) == 0 {
+                if binaryResults { return Data() }
                 return ["_type": "binary", "_data": ""]
             }
             if let blob = sqlite3_column_blob(stmt, index) {
                 let size = sqlite3_column_bytes(stmt, index)
                 let data = Data(bytes: blob, count: Int(size))
+                if binaryResults { return data }
                 return [
                     "_type": "binary",
                     "_data": data.base64EncodedString()

package/ios/Sources/CapgoCapacitorFastSqlPlugin/SQLHTTPServer.swift

@@ -100,7 +100,7 @@ class SQLHTTPServer {
         guard let server = server else { return }
 
         // CORS preflight for all endpoints
-        let preflightPaths = ["/execute", "/batch", "/transaction/begin", "/transaction/commit", "/transaction/rollback"]
+        let preflightPaths = ["/execute", "/batch", "/echo", "/transaction/begin", "/transaction/commit", "/transaction/rollback"]
         for path in preflightPaths {
             server.route(.OPTIONS, path) { [weak self] _ in
                 guard let self = self else {
@@ -126,6 +126,11 @@ class SQLHTTPServer {
             return self.addCorsHeaders(self.handleBatchRequest(request: request))
         }
 
+        server.route(.POST, "/echo") { [weak self] request in
+            guard let self = self else { return HTTPResponse(.internalServerError) }
+            return self.addCorsHeaders(self.handleDataRequest(request: request, kind: "echo"))
+        }
+
         // Transaction endpoints
         server.route(.POST, "/transaction/begin") { [weak self] request in
             guard let self = self else {
@@ -196,90 +201,68 @@ class SQLHTTPServer {
     // MARK: - Request Handlers
 
     private func handleExecuteRequest(request: HTTPRequest) -> HTTPResponse {
-        // Authenticate
-        guard let authHeader = request.headers["Authorization"],
-              authHeader == "Bearer \(token)" else {
-            return HTTPResponse(.unauthorized)
-        }
-
-        // Get database name
-        guard let database = request.headers["X-Database"] else {
-            let bodyData = "Database header required".data(using: .utf8)!
-            return HTTPResponse(.badRequest, body: bodyData)
-        }
-
-        // Check if database exists
-        guard let db = registeredDatabase(forKey: database) else {
-            let bodyData = "Database not found".data(using: .utf8)!
-            return HTTPResponse(.notFound, body: bodyData)
-        }
-
-        // Parse request body
-        let bodyData = request.body
-        guard let json = try? JSONSerialization.jsonObject(with: bodyData) as? [String: Any],
-              let statement = json["statement"] as? String else {
-            let errorData = "Invalid request body".data(using: .utf8)!
-            return HTTPResponse(.badRequest, body: errorData)
-        }
-
-        let params = (json["params"] as? [Any] ?? [])
-
-        do {
-            let result = try db.execute(statement: statement, params: params)
-            let resultData = try JSONSerialization.data(withJSONObject: result)
-            return HTTPResponse(.ok, headers: [.contentType: "application/json"], body: resultData)
-        } catch {
-            let errorData = "Error: \(error.localizedDescription)".data(using: .utf8)!
-            return HTTPResponse(.internalServerError, body: errorData)
-        }
+        return handleDataRequest(request: request, kind: "execute")
     }
 
     private func handleBatchRequest(request: HTTPRequest) -> HTTPResponse {
-        // Authenticate
-        guard let authHeader = request.headers["Authorization"],
-              authHeader == "Bearer \(token)" else {
-            return HTTPResponse(.unauthorized)
-        }
-
-        // Get database name
-        guard let database = request.headers["X-Database"] else {
-            let bodyData = "Database header required".data(using: .utf8)!
-            return HTTPResponse(.badRequest, body: bodyData)
-        }
-
-        // Check if database exists
-        guard let db = registeredDatabase(forKey: database) else {
-            let bodyData = "Database not found".data(using: .utf8)!
-            return HTTPResponse(.notFound, body: bodyData)
-        }
-
-        // Parse request body
-        let bodyData = request.body
-        guard let json = try? JSONSerialization.jsonObject(with: bodyData) as? [String: Any],
-              let operations = json["operations"] as? [[String: Any]] else {
-            let errorData = "Invalid request body".data(using: .utf8)!
-            return HTTPResponse(.badRequest, body: errorData)
-        }
-
-        var results: [[String: Any]] = []
+        return handleDataRequest(request: request, kind: "batch")
+    }
 
+    private func handleDataRequest(request: HTTPRequest, kind: String) -> HTTPResponse {
+        guard request.headers["Authorization"] == "Bearer \(token)" else { return HTTPResponse(.unauthorized) }
+        guard let database = request.headers["X-Database"] else { return HTTPResponse(.badRequest) }
+        guard let db = registeredDatabase(forKey: database) else { return HTTPResponse(.notFound) }
+        guard request.body.count <= BinaryFrame.maxBytes else { return HTTPResponse(.payloadTooLarge) }
+        let binary = request.headers["Content-Type"] == BinaryFrame.contentType
         do {
-            for operation in operations {
-                guard let statement = operation["statement"] as? String else {
-                    let errorData = "Invalid operation: missing statement".data(using: .utf8)!
-                    return HTTPResponse(.badRequest, body: errorData)
+            let decoded: Any
+            if binary {
+                decoded = try BinaryFrame.decode(request.body)
+            } else {
+                guard let json = try? JSONSerialization.jsonObject(with: request.body) else { throw BinaryFrameError.invalid }
+                decoded = json
+            }
+            guard let json = decoded as? [String: Any] else { throw BinaryFrameError.invalid }
+            let result: Any
+            if kind == "batch" {
+                guard let operations = json["operations"] as? [[String: Any]], operations.count <= 10000 else { throw BinaryFrameError.invalid }
+                let parsed = try operations.map { try parseOperation($0) }
+                result = try parsed.map { try db.execute(statement: $0.statement, params: $0.params, binaryResults: binary) }
+            } else {
+                let operation = try parseOperation(json)
+                let params = operation.params
+                if kind == "echo" {
+                    guard params.count == 1 else { throw BinaryFrameError.invalid }
+                    result = ["rows": [["value": params[0]]], "rowsAffected": 0]
+                } else {
+                    result = try db.execute(statement: operation.statement, params: params, binaryResults: binary)
                 }
-                let params = (operation["params"] as? [Any] ?? [])
-                let result = try db.execute(statement: statement, params: params)
-                results.append(result)
             }
-
-            let resultData = try JSONSerialization.data(withJSONObject: results)
-            return HTTPResponse(.ok, headers: [.contentType: "application/json"], body: resultData)
+            let data: Data
+            do {
+                if !binary && !JSONSerialization.isValidJSONObject(result) { throw BinaryFrameError.invalid }
+                data = try binary ? BinaryFrame.encode(result) : JSONSerialization.data(withJSONObject: result)
+            } catch {
+                return HTTPResponse(.internalServerError, body: Data("Could not encode SQL response; a write may already be committed".utf8))
+            }
+            return HTTPResponse(.ok, headers: [.contentType: binary ? BinaryFrame.contentType : "application/json"], body: data)
+        } catch is BinaryFrameError {
+            return HTTPResponse(.badRequest, body: Data("Invalid binary/SQL request".utf8))
         } catch {
-            let errorData = "Error: \(error.localizedDescription)".data(using: .utf8)!
-            return HTTPResponse(.internalServerError, body: errorData)
+            return HTTPResponse(.internalServerError, body: Data("Error: \(error.localizedDescription)".utf8))
+        }
+    }
+
+    private func parseOperation(_ operation: [String: Any]) throws -> (statement: String, params: [Any]) {
+        guard let statement = operation["statement"] as? String else { throw BinaryFrameError.invalid }
+        if let raw = operation["params"], !(raw is [Any]) { throw BinaryFrameError.invalid }
+        for value in operation["params"] as? [Any] ?? [] {
+            if value is NSNull || value is String || value is Data { continue }
+            if let number = value as? NSNumber, number.doubleValue.isFinite { continue }
+            if let blob = value as? [String: Any], blob["_type"] as? String == "binary", blob["_data"] is String { continue }
+            throw BinaryFrameError.invalid
         }
+        return (statement, operation["params"] as? [Any] ?? [])
     }
 
     private func handleBeginTransactionRequest(request: HTTPRequest) -> HTTPResponse {

package/ios/Tests/CapgoCapacitorFastSqlPluginTests/BinaryFrameTests.swift

@@ -0,0 +1,65 @@
+import XCTest
+@testable import CapgoCapacitorFastSqlPlugin
+
+final class BinaryFrameTests: XCTestCase {
+    func testHTTPRejectsInfiniteResponsesWithoutCrashing() async throws {
+        let database = try SQLDatabase(path: ":memory:")
+        let server = try SQLHTTPServer(databases: ["test": database])
+        try server.start()
+        defer { server.stop(); database.close() }
+        for binary in [false, true] {
+            let url = try XCTUnwrap(URL(string: "http://127.0.0.1:\(server.port)/execute"))
+            var request = URLRequest(url: url)
+            request.httpMethod = "POST"
+            request.timeoutInterval = 10
+            request.setValue("Bearer \(server.token)", forHTTPHeaderField: "Authorization")
+            request.setValue("test", forHTTPHeaderField: "X-Database")
+            request.setValue(binary ? BinaryFrame.contentType : "application/json", forHTTPHeaderField: "Content-Type")
+            let payload: [String: Any] = ["statement": "SELECT 1e999 AS value", "params": []]
+            request.httpBody = try binary ? BinaryFrame.encode(payload) : JSONSerialization.data(withJSONObject: payload)
+            let (_, response) = try await URLSession.shared.data(for: request)
+            XCTAssertEqual((response as? HTTPURLResponse)?.statusCode, 500)
+        }
+    }
+
+    func testSharedJavaScriptGolden() throws {
+        let url = try XCTUnwrap(Bundle.module.url(forResource: "binary-v1", withExtension: "bin", subdirectory: "Fixtures"))
+        let request = try XCTUnwrap(try BinaryFrame.decode(Data(contentsOf: url)) as? [String: Any])
+        let params = try XCTUnwrap(request["params"] as? [Any])
+        XCTAssertEqual(params[0] as? Data, Data([0, 1, 255]))
+        XCTAssertEqual(params[1] as? Data, Data())
+        XCTAssertEqual(params[2] as? Double, 1.25)
+        XCTAssertEqual(params[3] as? String, "😀")
+    }
+
+    func testRawDataSQLiteRoundTrip() throws {
+        let database = try SQLDatabase(path: ":memory:")
+        defer { database.close() }
+        let result = try database.execute(statement: "SELECT ? AS bytes, ? AS empty, ? AS missing, ? AS fraction", params: [Data([0, 1, 255]), Data(), NSNull(), 1.25], binaryResults: true)
+        let decoded = try XCTUnwrap(try BinaryFrame.decode(BinaryFrame.encode(result)) as? [String: Any])
+        let rows = try XCTUnwrap(decoded["rows"] as? [[String: Any]])
+        XCTAssertEqual(rows[0]["bytes"] as? Data, Data([0, 1, 255]))
+        XCTAssertEqual(rows[0]["empty"] as? Data, Data())
+        XCTAssertTrue(rows[0]["missing"] is NSNull)
+        XCTAssertEqual(rows[0]["fraction"] as? Double, 1.25)
+    }
+
+    func testMalformedFrames() throws {
+        for number in [Double.infinity, -Double.infinity, Double.nan] {
+            XCTAssertThrowsError(try BinaryFrame.encode(["rows": [["value": number]]]))
+        }
+        let database = try SQLDatabase(path: ":memory:")
+        defer { database.close() }
+        let infinite = try database.execute(statement: "SELECT 1e999 AS value", params: [], binaryResults: true)
+        XCTAssertThrowsError(try BinaryFrame.encode(infinite))
+        XCTAssertFalse(JSONSerialization.isValidJSONObject(infinite))
+        let valid = try BinaryFrame.encode(["value": Data([1, 2])])
+        XCTAssertThrowsError(try BinaryFrame.decode(valid.dropLast()))
+        var version = valid
+        version[3] = 50
+        XCTAssertThrowsError(try BinaryFrame.decode(version))
+        for reference in [[-1.0, 1], [0, 999], [0.5, 0]] {
+            XCTAssertThrowsError(try BinaryFrame.decode(BinaryFrame.encode(["$blob": reference])))
+        }
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capgo/capacitor-fast-sql",
-  "version": "8.2.18",
+  "version": "8.3.1",
   "description": "High-performance native SQLite plugin with custom protocol for efficient sync operations and IndexedDB replacement",
   "main": "dist/plugin.cjs.js",
   "module": "dist/esm/index.js",
@@ -57,7 +57,8 @@
     "example:install": "cd example-app && bun install --frozen-lockfile",
     "example:build": "bun run build && cd example-app && bun install --frozen-lockfile && bun run build",
     "changelog:ai": "node scripts/generate-ai-changelog.mjs",
-    "benchmark:check": "bun test tests/benchmark.test.ts && tsc -p benchmarks/tsconfig.json"
+    "benchmark:check": "bun test tests/benchmark.test.ts && tsc -p benchmarks/tsconfig.json",
+    "test:unit": "bun test tests"
   },
   "dependencies": {
     "@sqlite.org/sqlite-wasm": "3.53.0-build1"