@carllee1983/dbcli 1.47.0 → 1.48.0

package/dist/core.d.ts

@@ -560,6 +560,12 @@ export interface QueryResult<T> {
 	/** Internal row-limit proof, mapped into public JSON metadata by the formatter. */
 	appliedLimit?: AppliedLimitMetadata;
 }
+declare const SQL_DIALECTS: readonly [
+	"postgresql",
+	"mysql",
+	"mariadb"
+];
+type SqlDialect = (typeof SQL_DIALECTS)[number];
 /**
  * Manager class for loading and querying blacklist rules.
  * Instantiate once per CLI invocation.
@@ -601,6 +607,16 @@ export declare class BlacklistManager {
 	 * @returns Array of blacklisted column names, or empty array if none
 	 */
 	getBlacklistedColumns(tableName: string): string[];
+	/**
+	 * Every blacklisted column name, across all tables.
+	 *
+	 * Used when a statement's tables could not be identified: applying every
+	 * rule is the reading of "I do not know which table this came from" that
+	 * does not disclose data.
+	 *
+	 * @returns Array of blacklisted column names, deduplicated
+	 */
+	getAllBlacklistedColumns(): string[];
 	/**
 	 * Check if the blacklist override is enabled via environment variable.
 	 * When true, all blacklist checks are bypassed.
@@ -630,10 +646,50 @@ export declare class BlacklistValidator {
 	 *
 	 * @param operation SQL operation type: SELECT, INSERT, UPDATE, DELETE
 	 * @param tableName Table name to check
-	 * @param _tableList Unused (reserved for future multi-table validation)
-	 * @throws BlacklistError if table is blacklisted
+	 * @param tableList Further tables the same statement references
+	 * @throws BlacklistError if any table is blacklisted
+	 */
+	checkTableBlacklist(operation: string, tableName: string, tableList?: string[]): void;
+	/**
+	 * Check every table a statement references.
+	 *
+	 * A statement is blocked when *any* referenced table is blacklisted — the
+	 * table reached through a JOIN, a comma, or a UNION branch is as sensitive as
+	 * the one named first (issue #23).
+	 *
+	 * @param operation SQL operation type: SELECT, INSERT, UPDATE, DELETE
+	 * @param tableNames Every table the statement references
+	 * @throws BlacklistError if any table is blacklisted
+	 */
+	checkTablesBlacklist(operation: string, tableNames: string[]): void;
+	/**
+	 * Check an Elasticsearch index expression against the table blacklist.
+	 *
+	 * `--index` is not a name: Elasticsearch accepts a comma list and wildcards,
+	 * so `secrets,orders`, `sec*`, `*` and `_all` all read a blacklisted index
+	 * while matching no blacklist entry by equality. Concrete names are checked
+	 * directly; a wildcard is refused when it *could* match a blacklisted index,
+	 * since which indices exist is server-side knowledge.
+	 *
+	 * @param operation Operation label for the error message
+	 * @param target Raw `--index` expression
+	 * @throws BlacklistError if any named or matchable index is blacklisted
 	 */
-	checkTableBlacklist(operation: string, tableName: string, _tableList?: string[]): void;
+	checkIndexBlacklist(operation: string, target: string): void;
+	/**
+	 * Mask result fields for an Elasticsearch index *expression*.
+	 *
+	 * `filterColumns` looks the name up by equality, so `--index 'us*'` or
+	 * `--index 'users,orders'` matched no rule and returned every protected field
+	 * — the table check passing is not enough when only columns are blacklisted.
+	 * A wildcard is resolved server-side, so every rule it could reach is
+	 * applied.
+	 *
+	 * @param target Raw `--index` expression
+	 * @param rows Result documents
+	 * @param columnList Field names in the result
+	 */
+	filterColumnsForIndexExpression(target: string, rows: Record<string, unknown>[], columnList: string[]): FilterColumnsResult;
 	/**
 	 * Reject a write that touches blacklisted columns.
 	 * Computes the intersection of `fields` with the table's column blacklist
@@ -656,6 +712,22 @@ export declare class BlacklistValidator {
 	 * @returns Filtered rows and list of omitted column names
 	 */
 	filterColumns(tableName: string, rows: Record<string, unknown>[], columnList: string[]): FilterColumnsResult;
+	/**
+	 * Filter blacklisted columns using the rules of every referenced table.
+	 *
+	 * A result set built from a JOIN carries columns from several tables, and the
+	 * driver returns them unqualified — `u.password_hash` arrives as
+	 * `password_hash`. Attribution is therefore not recoverable from the result,
+	 * so a column blacklisted on *any* referenced table is omitted. That errs
+	 * towards hiding a same-named column of an innocent table, which is the
+	 * direction that does not disclose data.
+	 *
+	 * @param tableNames Every table the statement references
+	 * @param rows Query result rows
+	 * @param columnList Column names in result set
+	 * @returns Filtered rows and list of omitted column names
+	 */
+	filterColumnsForTables(tableNames: string[], rows: Record<string, unknown>[], columnList: string[]): FilterColumnsResult;
 	/**
 	 * Build a security notification message for omitted columns.
 	 *
@@ -2833,7 +2905,18 @@ export declare class QueryExecutor {
 		connectionName?: string;
 		recovery?: boolean;
 		deferDiagnostics?: boolean;
+		/**
+		 * Quoting rules that decide what counts as a statement separator differ
+		 * per dialect. Without this, the stacking check has to fail closed.
+		 */
+		dialect?: SqlDialect;
 	});
+	/**
+	 * The dialect the statement will actually run under. Falls back to the
+	 * connection config, then to undefined — where the stacking check fails
+	 * closed rather than guessing.
+	 */
+	private resolveDialect;
 	takeDiagnostics(): string[];
 	/**
 	 * Execute a SQL query with permission enforcement and error handling