@dwtechs/antity-pgsql 0.17.4 → 0.17.5

package/README.md

@@ -2,7 +2,7 @@
 [![License: MIT](https://img.shields.io/npm/l/@dwtechs/antity-pgsql.svg?color=brightgreen)](https://opensource.org/licenses/MIT)
 [![npm version](https://badge.fury.io/js/%40dwtechs%2Fantity-pgsql.svg)](https://www.npmjs.com/package/@dwtechs/antity-pgsql)
 [![last version release date](https://img.shields.io/github/release-date/DWTechs/Antity-pgsql.js)](https://www.npmjs.com/package/@dwtechs/antity-pgsql)
-![Jest:coverage](https://img.shields.io/badge/Jest:coverage-87%25-brightgreen.svg)
+![Jest:coverage](https://img.shields.io/badge/Jest:coverage-89%25-brightgreen.svg)
 
 - [Synopsis](#synopsis)
 - [Support](#support)
@@ -333,7 +333,7 @@ Using substacks simplifies your route definitions and ensures consistent data pr
 
 ### Query Methods
 
-- **query.select()**: Generates a SELECT query. When the `rows` parameter is provided (not null), pagination is automatically enabled and the query includes `COUNT(*) OVER () AS total` to return the total number of rows. The total count is extracted from results and returned separately from the row data.
+- **query.select()**: Generates a SELECT query. When the `rows` parameter is provided (not null), pagination is automatically enabled and the query includes `COUNT(*) OVER () AS total` to return the total number of rows. The total count is extracted from results and returned separately from the row data. The `sortField` parameter is validated against the entity's known properties; an unrecognised value is silently dropped.
 - **query.insert()**: Generates an INSERT query. Accepts an array of `Row` objects with properties matching the entity definition. Consumer fields are appended directly to the query arguments — row objects are **not mutated**. Optionally appends `consumer.id` as `creatorId` and `consumer.nickname` as `creatorName` for audit tracking. Supports `RETURNING` clause via the `rtn` parameter.
 - **query.update()**: Generates an UPDATE query using CASE statements. Accepts an array of `Row` objects with `id` property. Optionally appends `consumer.id` as `updaterId` and `consumer.nickname` as `updaterName` for audit tracking.
 - **query.upsert()**: Generates an INSERT ... ON CONFLICT ... DO UPDATE query. (See [Upsert](#upsert-insert-or-update) section below.) Accepts an array of `Row` objects and a `conflictTarget` (single column name or array of column names) that defines uniqueness. If a conflict occurs on the specified column(s), the row is updated; otherwise, it is inserted. Properties are automatically included if they have both INSERT and UPDATE operations. Consumer fields are appended directly to the query arguments — row objects are **not mutated**. Optionally appends `consumer.id` as `creatorId` and `consumer.nickname` as `creatorName` for audit tracking. Supports `RETURNING` clause via the `rtn` parameter.

package/dist/antity-pgsql.js

@@ -100,7 +100,7 @@ const reserved = new Set([
 ]);
 function quoteIfUppercase(word) {
     if (/[A-Z]/.test(word) || reserved.has(word.toLowerCase()))
-        return `"${word}"`;
+        return `"${word.replace(/"/g, '""')}"`;
     return word;
 }
 
@@ -307,11 +307,11 @@ class Insert {
             nbProps += 2;
             cols += `, "creatorId", "creatorName"`;
         }
-        let query = `INSERT INTO ${quoteIfUppercase(schema)}.${quoteIfUppercase(table)} (${cols}) VALUES `;
         const args = [];
+        const valueParts = [];
         let i = 0;
         for (const row of rows) {
-            query += `${$i(nbProps, i)}, `;
+            valueParts.push($i(nbProps, i));
             for (const prop of propsToUse) {
                 if (prop === "consumerId")
                     args.push(consumerId);
@@ -322,7 +322,7 @@ class Insert {
             }
             i += nbProps;
         }
-        query = query.slice(0, -2);
+        let query = `INSERT INTO ${quoteIfUppercase(schema)}.${quoteIfUppercase(table)} (${cols}) VALUES ${valueParts.join(", ")}`;
         if (rtn)
             query += ` ${rtn}`;
         return { query, args };
@@ -348,8 +348,8 @@ class Update {
         log.debug(() => `${LOGS_PREFIX}Update query input rows: ${JSON.stringify(rows, null, 2)}`);
         const l = rows.length;
         const args = rows.map(row => row.id);
-        let query = `UPDATE ${quoteIfUppercase(schema)}.${quoteIfUppercase(table)} SET `;
         let i = args.length + 1;
+        const setClauses = [];
         for (const p of propsToUse) {
             const isConsumerId = p === "consumerId";
             const isConsumerName = p === "consumerName";
@@ -357,9 +357,9 @@ class Update {
             if (!isConsumerProp && rows[0][p] === undefined)
                 continue;
             const colName = isConsumerId ? '"updaterId"' : isConsumerName ? '"updaterName"' : quoteIfUppercase(p);
-            query += `${colName} = CASE `;
+            const whenParts = [];
             for (let j = 0; j < l; j++) {
-                query += `WHEN id = $${j + 1} THEN $${i++} `;
+                whenParts.push(`WHEN id = $${j + 1} THEN $${i++}`);
                 if (isConsumerId)
                     args.push(consumerId);
                 else if (isConsumerName)
@@ -367,9 +367,9 @@ class Update {
                 else
                     args.push(rows[j][p]);
             }
-            query += `ELSE ${colName} END, `;
+            setClauses.push(`${colName} = CASE ${whenParts.join(" ")} ELSE ${colName} END`);
         }
-        query = `${query.slice(0, -2)} WHERE id IN ${$i(l, 0)}`;
+        const query = `UPDATE ${quoteIfUppercase(schema)}.${quoteIfUppercase(table)} SET ${setClauses.join(", ")} WHERE id IN ${$i(l, 0)}`;
         return { query, args };
     }
     async execute(query, args, client) {
@@ -421,16 +421,13 @@ class Upsert {
             i += nbProps;
         }
         query = query.slice(0, -2);
-        query += ` ON CONFLICT (${conflictColumns}) DO UPDATE SET `;
         const conflictTargetArray = Array.isArray(conflictTarget) ? conflictTarget : [conflictTarget];
         const updateCols = quotedPropsToUse.filter((_, idx) => {
             const propName = propsToUse[idx];
             return !conflictTargetArray.includes(propName);
         });
-        for (const col of updateCols) {
-            query += `${col} = EXCLUDED.${col}, `;
-        }
-        query = query.slice(0, -2);
+        const updateSetClause = updateCols.map(col => `${col} = EXCLUDED.${col}`).join(", ");
+        query += ` ON CONFLICT (${conflictColumns}) DO UPDATE SET ${updateSetClause}`;
         if (rtn)
             query += ` ${rtn}`;
         return { query, args };
@@ -471,14 +468,7 @@ function queryByDate() {
     return `SELECT hard_delete($1, $2, $3)`;
 }
 async function executeArchived(schema, table, date, query, client) {
-    let db;
-    try {
-        db = await execute(query, [schema, table, date], client);
-    }
-    catch (err) {
-        throw err;
-    }
-    return db;
+    return execute(query, [schema, table, date], client);
 }
 
 function type(type) {
@@ -706,7 +696,8 @@ class SQLEntity extends Entity {
     }
     query = {
         select: (first = 0, rows = null, sortField = null, sortOrder = null, filters = null) => {
-            return this.sel.query(this.schema, this.table, first, rows, sortField, sortOrder, filters);
+            const validatedSortField = sortField && this.properties.some(p => p.key === sortField) ? sortField : null;
+            return this.sel.query(this.schema, this.table, first, rows, validatedSortField, sortOrder, filters);
         },
         update: (rows, consumer) => {
             return this.upd.query(this.schema, this.table, rows, consumer?.id, consumer?.nickname);
@@ -735,7 +726,8 @@ class SQLEntity extends Entity {
         const b = req.body;
         const first = b?.first ?? 0;
         const rows = b.rows || null;
-        const sortField = b.sortField || null;
+        const rawSortField = b.sortField || null;
+        const sortField = rawSortField && this.properties.some(p => p.key === rawSortField) ? rawSortField : null;
         const sortOrder = b.sortOrder === -1 || b.sortOrder === "DESC" ? "DESC" : "ASC";
         const filters = cleanFilters(b.filters, this.properties) || null;
         const pagination = b.pagination || false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dwtechs/antity-pgsql",
-  "version": "0.17.4",
+  "version": "0.17.5",
   "description": "Open source library to add PostgreSQL support to @dwtechs/Antity entities.",
   "keywords": [
     "entities"
@@ -36,7 +36,7 @@
   "dependencies": {
     "@dwtechs/checkard": "3.6.0",
     "@dwtechs/winstan": "0.7.0",
-    "@dwtechs/antity": "0.17.0",
+    "@dwtechs/antity": "0.18.0",
     "@dwtechs/sparray": "0.2.1",
     "pg": "8.20.0"
   },