@carbonorm/carbonnode 4.0.0 → 5.0.0

package/src/api/handlers/ExpressHandler.ts

@@ -7,7 +7,15 @@ import {iC6Object, iRestMethods} from "../types/ormInterfaces";
 
 // TODO - WE MUST make this a generic - optional, but helpful
 // note sure how it would help anyone actually...
-export function ExpressHandler({C6, mysqlPool}: { C6: iC6Object, mysqlPool: Pool }) {
+export function ExpressHandler({
+    C6,
+    mysqlPool,
+    sqlAllowListPath,
+}: {
+    C6: iC6Object;
+    mysqlPool: Pool;
+    sqlAllowListPath?: string;
+}) {
 
     return async (req: Request, res: Response, next: NextFunction) => {
         try {
@@ -92,6 +100,7 @@ export function ExpressHandler({C6, mysqlPool}: { C6: iC6Object, mysqlPool: Pool
             const response = await restRequest({
                 C6,
                 mysqlPool,
+                sqlAllowListPath,
                 requestMethod: method,
                 restModel: C6.TABLES[table]
             })(payload);

package/src/api/orm/builders/ConditionBuilder.ts

@@ -378,19 +378,19 @@ export abstract class ConditionBuilder<
         throw new Error('Unsupported operand type in SQL expression.');
     }
 
-    private isPlainArrayLiteral(value: any): boolean {
+    private isPlainArrayLiteral(value: any, allowColumnRefs = false): boolean {
         if (!Array.isArray(value)) return false;
         return value.every(item => {
             if (item === null) return true;
             const type = typeof item;
             if (type === 'string' || type === 'number' || type === 'boolean') return true;
-            if (Array.isArray(item)) return this.isPlainArrayLiteral(item);
-            if (item && typeof item === 'object') return this.isPlainObjectLiteral(item);
+            if (Array.isArray(item)) return this.isPlainArrayLiteral(item, allowColumnRefs);
+            if (item && typeof item === 'object') return this.isPlainObjectLiteral(item, allowColumnRefs);
             return false;
         });
     }
 
-    private isPlainObjectLiteral(value: any): boolean {
+    private isPlainObjectLiteral(value: any, allowColumnRefs = false): boolean {
         if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
         if (value instanceof Date) return false;
         if (typeof Buffer !== 'undefined' && Buffer.isBuffer && Buffer.isBuffer(value)) return false;
@@ -405,13 +405,30 @@ export abstract class ConditionBuilder<
             return false;
         }
 
-        if (entries.some(([key]) => typeof key === 'string' && (this.isColumnRef(key) || key.includes('.')))) {
-            return false;
+        if (!allowColumnRefs) {
+            if (entries.some(([key]) => typeof key === 'string' && (this.isColumnRef(key) || key.includes('.')))) {
+                return false;
+            }
         }
 
         return true;
     }
 
+    private resolveColumnDefinition(column?: string): any | undefined {
+        if (!column || typeof column !== 'string' || !column.includes('.')) return undefined;
+        const [prefix, colName] = column.split('.', 2);
+        const tableName = this.aliasMap[prefix] ?? prefix;
+        const table = this.config.C6?.TABLES?.[tableName];
+        if (!table?.TYPE_VALIDATION) return undefined;
+        return table.TYPE_VALIDATION[colName] ?? table.TYPE_VALIDATION[`${tableName}.${colName}`];
+    }
+
+    private isJsonColumn(column?: string): boolean {
+        const columnDef = this.resolveColumnDefinition(column);
+        const mysqlType = columnDef?.MYSQL_TYPE;
+        return typeof mysqlType === 'string' && mysqlType.toLowerCase().includes('json');
+    }
+
     protected serializeUpdateValue(
         value: any,
         params: any[] | Record<string, any>,
@@ -419,7 +436,10 @@ export abstract class ConditionBuilder<
     ): string {
         const normalized = value instanceof Map ? Object.fromEntries(value) : value;
 
-        if (this.isPlainArrayLiteral(normalized) || this.isPlainObjectLiteral(normalized)) {
+        const allowColumnRefs = this.isJsonColumn(contextColumn);
+
+        if (this.isPlainArrayLiteral(normalized, allowColumnRefs)
+            || this.isPlainObjectLiteral(normalized, allowColumnRefs)) {
             return this.addParam(params, contextColumn ?? '', JSON.stringify(normalized));
         }
 

package/src/api/types/ormInterfaces.ts

@@ -162,6 +162,19 @@ export type DetermineResponseDataType<
                     ? iDeleteC6RestResponse<RestTableInterface>
                     : never);
 
+
+export type iRestWebsocketPayload = {
+    REST: {
+        TABLE_NAME: string;
+        TABLE_PREFIX: string;
+        METHOD: iRestMethods;
+        REQUEST: Record<string, any>;
+        REQUEST_PRIMARY_KEY: Record<string, any> | null;
+    };
+};
+
+export type tWebsocketBroadcast = (payload: iRestWebsocketPayload) => void | Promise<void>;
+
 export interface iRest<
     RestShortTableName extends string = any,
     RestTableInterface extends Record<string, any> = any,
@@ -177,7 +190,9 @@ export interface iRest<
     requestMethod: iRestMethods;
     clearCache?: () => void;
     skipPrimaryCheck?: boolean;
+    websocketBroadcast?: tWebsocketBroadcast;
     verbose?: boolean;
+    sqlAllowListPath?: string;
 }
 
 export interface iConstraint {

package/src/api/utils/sqlAllowList.ts

@@ -0,0 +1,54 @@
+import isNode from "../../variables/isNode";
+
+const allowListCache = new Map<string, Set<string>>();
+
+export const normalizeSql = (sql: string): string =>
+    sql.replace(/\s+/g, " ").trim();
+
+const parseAllowList = (raw: string, sourcePath: string): string[] => {
+    let parsed: unknown;
+    try {
+        parsed = JSON.parse(raw);
+    } catch (error) {
+        throw new Error(`SQL allowlist at ${sourcePath} is not valid JSON.`);
+    }
+
+    if (!Array.isArray(parsed)) {
+        throw new Error(`SQL allowlist at ${sourcePath} must be a JSON array of strings.`);
+    }
+
+    const sqlEntries = parsed
+        .filter((entry): entry is string => typeof entry === "string")
+        .map(normalizeSql)
+        .filter((entry) => entry.length > 0);
+
+    if (sqlEntries.length !== parsed.length) {
+        throw new Error(`SQL allowlist at ${sourcePath} must contain only string entries.`);
+    }
+
+    return sqlEntries;
+};
+
+export const loadSqlAllowList = async (allowListPath: string): Promise<Set<string>> => {
+    if (allowListCache.has(allowListPath)) {
+        return allowListCache.get(allowListPath)!;
+    }
+
+    if (!isNode()) {
+        throw new Error("SQL allowlist validation requires a Node runtime.");
+    }
+
+    const {readFile} = await import("node:fs/promises");
+
+    let raw: string;
+    try {
+        raw = await readFile(allowListPath, "utf-8");
+    } catch (error) {
+        throw new Error(`SQL allowlist file not found at ${allowListPath}.`);
+    }
+
+    const sqlEntries = parseAllowList(raw, allowListPath);
+    const allowList = new Set(sqlEntries);
+    allowListCache.set(allowListPath, allowList);
+    return allowList;
+};

package/src/index.ts

@@ -37,6 +37,7 @@ export * from "./api/utils/determineRuntimeJsType";
 export * from "./api/utils/logger";
 export * from "./api/utils/normalizeSingularRequest";
 export * from "./api/utils/sortAndSerializeQueryObject";
+export * from "./api/utils/sqlAllowList";
 export * from "./api/utils/testHelpers";
 export * from "./api/utils/toastNotifier";
 export * from "./variables/getEnvVar";