@carbonorm/carbonnode 4.0.1 → 5.0.0

package/src/api/types/ormInterfaces.ts

@@ -162,6 +162,19 @@ export type DetermineResponseDataType<
                     ? iDeleteC6RestResponse<RestTableInterface>
                     : never);
 
+
+export type iRestWebsocketPayload = {
+    REST: {
+        TABLE_NAME: string;
+        TABLE_PREFIX: string;
+        METHOD: iRestMethods;
+        REQUEST: Record<string, any>;
+        REQUEST_PRIMARY_KEY: Record<string, any> | null;
+    };
+};
+
+export type tWebsocketBroadcast = (payload: iRestWebsocketPayload) => void | Promise<void>;
+
 export interface iRest<
     RestShortTableName extends string = any,
     RestTableInterface extends Record<string, any> = any,
@@ -177,7 +190,9 @@ export interface iRest<
     requestMethod: iRestMethods;
     clearCache?: () => void;
     skipPrimaryCheck?: boolean;
+    websocketBroadcast?: tWebsocketBroadcast;
     verbose?: boolean;
+    sqlAllowListPath?: string;
 }
 
 export interface iConstraint {

package/src/api/utils/sqlAllowList.ts

@@ -0,0 +1,54 @@
+import isNode from "../../variables/isNode";
+
+const allowListCache = new Map<string, Set<string>>();
+
+export const normalizeSql = (sql: string): string =>
+    sql.replace(/\s+/g, " ").trim();
+
+const parseAllowList = (raw: string, sourcePath: string): string[] => {
+    let parsed: unknown;
+    try {
+        parsed = JSON.parse(raw);
+    } catch (error) {
+        throw new Error(`SQL allowlist at ${sourcePath} is not valid JSON.`);
+    }
+
+    if (!Array.isArray(parsed)) {
+        throw new Error(`SQL allowlist at ${sourcePath} must be a JSON array of strings.`);
+    }
+
+    const sqlEntries = parsed
+        .filter((entry): entry is string => typeof entry === "string")
+        .map(normalizeSql)
+        .filter((entry) => entry.length > 0);
+
+    if (sqlEntries.length !== parsed.length) {
+        throw new Error(`SQL allowlist at ${sourcePath} must contain only string entries.`);
+    }
+
+    return sqlEntries;
+};
+
+export const loadSqlAllowList = async (allowListPath: string): Promise<Set<string>> => {
+    if (allowListCache.has(allowListPath)) {
+        return allowListCache.get(allowListPath)!;
+    }
+
+    if (!isNode()) {
+        throw new Error("SQL allowlist validation requires a Node runtime.");
+    }
+
+    const {readFile} = await import("node:fs/promises");
+
+    let raw: string;
+    try {
+        raw = await readFile(allowListPath, "utf-8");
+    } catch (error) {
+        throw new Error(`SQL allowlist file not found at ${allowListPath}.`);
+    }
+
+    const sqlEntries = parseAllowList(raw, allowListPath);
+    const allowList = new Set(sqlEntries);
+    allowListCache.set(allowListPath, allowList);
+    return allowList;
+};

package/src/index.ts

@@ -37,6 +37,7 @@ export * from "./api/utils/determineRuntimeJsType";
 export * from "./api/utils/logger";
 export * from "./api/utils/normalizeSingularRequest";
 export * from "./api/utils/sortAndSerializeQueryObject";
+export * from "./api/utils/sqlAllowList";
 export * from "./api/utils/testHelpers";
 export * from "./api/utils/toastNotifier";
 export * from "./variables/getEnvVar";