@entity-access/entity-access 1.0.2 → 1.0.5

package/src/query/parser/Restructure.ts

@@ -0,0 +1,66 @@
+import * as bpe from "@babel/types";
+import { BabelVisitor } from "./BabelVisitor.js";
+import { NotSupportedError } from "./NotSupportedError.js";
+import TransformVisitor from "./TransformVisitor.js";
+
+export default class Restructure extends TransformVisitor {
+
+    private map: Map<string, bpe.Node> = new Map();
+
+    visitTemplateElement(node: bpe.TemplateElement): bpe.Node {
+        return node;
+    }
+
+    visitArrowFunctionExpression(node: bpe.ArrowFunctionExpression): bpe.Node {
+
+        // we need to restructure identifiers from destructure
+
+        node.params = node.params.map((x) => this.toIdentifier(x));
+
+        node.body = this.visit(node.body) as bpe.Expression;
+
+        return node;
+    }
+
+    visitIdentifier(node: bpe.Identifier): bpe.Node {
+        return this.map.get(node.name) ?? node;
+    }
+
+    toIdentifier(x: bpe.Identifier | bpe.Pattern | bpe.RestElement): bpe.Identifier {
+        switch(x.type) {
+            case "Identifier":
+                return x;
+            case "ObjectPattern":
+                const id = `x${this.map.size + 1}`;
+                const idExp = bpe.identifier(id);
+                this.convertPattern(idExp, x);
+                return idExp;
+            case "ArrayPattern":
+            case "AssignmentPattern":
+            case "RestElement":
+                throw new NotSupportedError();
+        }
+    }
+
+    convertPattern(parentExp: bpe.Expression, x: bpe.ObjectPattern) {
+        for (const iterator of x.properties) {
+            switch(iterator.type) {
+                case "RestElement":
+                    throw new NotSupportedError();
+                case "ObjectProperty":
+                    switch(iterator.key.type){
+                        case "Identifier":
+                            const childExp = bpe.memberExpression(parentExp, iterator.key);
+                            this.map.set(iterator.key.name, childExp);
+                            switch(iterator.value.type) {
+                                case "ObjectPattern":
+                                    this.convertPattern(childExp, iterator.value);
+                                    break;
+                            }
+                        break;
+                    }
+            }
+        }
+    }
+
+}

package/src/query/parser/TransformVisitor.ts

@@ -0,0 +1,83 @@
+import * as bpe from "@babel/types";
+import { BabelVisitor } from "./BabelVisitor.js";
+
+export default class TransformVisitor extends BabelVisitor<bpe.Node> {
+
+    transform<T>(n:T) {
+        if (!n) {
+            return n;
+        }
+        if (Array.isArray(n)) {
+            return n.map((x) => this.transform(x));
+        }
+        return this.visit(n as any);
+    }
+
+    visitTemplateElement(node: bpe.TemplateElement): bpe.Node {
+        return node;
+    }
+
+    visitObjectExpression(node: bpe.ObjectExpression): bpe.Node {
+        return bpe.objectExpression(
+            this.transform(node.properties)
+        );
+    }
+    visitMemberExpression(node: bpe.MemberExpression): bpe.Node {
+        return bpe.memberExpression(this.transform(node.object), this.transform(node.property), node.computed, node.optional);
+    }
+    visitLogicalExpression(node: bpe.LogicalExpression): bpe.Node {
+        return bpe.logicalExpression(node.operator, this.transform(node.left), this.transform(node.right));
+    }
+    visitIdentifier(node: bpe.Identifier): bpe.Node {
+        return node;
+    }
+    visitTemplateLiteral(node: bpe.TemplateLiteral): bpe.Node {
+        return bpe.templateLiteral(this.transform(node.quasis), this.transform(node.expressions));
+    }
+    visitNumericLiteral(node: bpe.NumericLiteral): bpe.Node {
+        return node;
+    }
+    visitDecimalLiteral(node: bpe.DecimalLiteral): bpe.Node {
+        return node;
+    }
+    visitBooleanLiteral(node: bpe.BooleanLiteral): bpe.Node {
+        return node;
+    }
+    visitBigIntLiteral(node: bpe.BigIntLiteral): bpe.Node {
+        return node;
+    }
+    visitStringLiteral(node: bpe.StringLiteral): bpe.Node {
+        return node;
+    }
+    visitNullLiteral(node: bpe.NullLiteral): bpe.Node {
+        return node;
+    }
+    visitConditionalExpression(node: bpe.ConditionalExpression): bpe.Node {
+        return bpe.conditionalExpression(
+            this.transform(node.test),
+            this.transform(node.consequent),
+            this.transform(node.alternate));
+    }
+    visitArrowFunctionExpression(node: bpe.ArrowFunctionExpression): bpe.Node {
+        return bpe.arrowFunctionExpression(this.transform(node.params), this.transform(node.body), node.async);
+    }
+    visitCallExpression(node: bpe.CallExpression): bpe.Node {
+        return bpe.callExpression(this.transform(node.callee), this.transform(node.arguments));
+    }
+    visitBinaryExpression(node: bpe.BinaryExpression): bpe.Node {
+        return bpe.binaryExpression(node.operator, this.transform(node.left), this.transform(node.right));
+    }
+
+    visitObjectProperty(node: bpe.ObjectProperty): bpe.Node {
+
+        let key = node.key;
+        if (node.key.type !== "Identifier") {
+            key = this.transform(key);
+        }
+
+        const value = this.transform(node.value);
+
+        return bpe.objectProperty(key, value, node.computed, node.shorthand, node.decorators);
+    }
+
+}

package/src/sql/ISql.ts

@@ -2,6 +2,16 @@ export interface ISql {
 
     in<T>(a: T, array: T[]): boolean;
 
+    cast: {
+        asNumber(a: any): number;
+        asInteger(a: any): number;
+        asBigInt(a: any): number;
+        asText(a: any): string;
+        asDate(a: any): Date;
+        asDateTime(a: any): Date;
+        asDecimal(a: any): number;
+    }
+
     text: {
         concat(... fragments: string[]): string;
         like(text: string, test: string): boolean;

package/src/tests/db-tests/tests/select-items.ts

@@ -34,4 +34,16 @@ export default async function(this: TestConfig) {
     allHeadphones = await context.products.where({ headPhoneCategory }, (p) => (x) => x.categories.some((pc) => pc.categoryID === p.headPhoneCategory)).count();
 
     assert.equal(6, allHeadphones);
+
+    const first = await context.productCategories.where({ headPhoneCategory }, (p) => (x) => x.category.categoryID === p.headPhoneCategory).first();
+
+    // delete first one...
+    context.products.delete(first);
+
+    await context.saveChanges();
+
+    allHeadphones = await context.products.where({ headPhoneCategory }, (p) => (x) => x.categories.some((pc) => pc.categoryID === p.headPhoneCategory)).count();
+
+    assert.equal(5, allHeadphones);
+
 }

package/src/tests/expressions/left-joins/child-joins.ts

@@ -5,45 +5,38 @@ import { assertSqlMatch, trimInternal } from "../trimInternal.js";
 import PostgreSqlDriver from "../../../drivers/postgres/PostgreSqlDriver.js";
 
 const sql1 = `SELECT
-    "P1"."productID",
-    "P1"."name",
-    "P1"."ownerID"
+"P1"."productID","P1"."name","P1"."ownerID","P1"."status"
 FROM "Products" AS "P1"
-WHERE
-    EXISTS (SELECT
-                $1 AS "o1"
-        FROM "OrderItems" AS "O0"
-        WHERE 
-            ("P1"."productID" = "O0"."productID")
-            AND ("O0"."productID" = $2)
-            )
-        `;
+WHERE EXISTS (SELECT
+1
+FROM "OrderItems" AS "O0"
+WHERE ("P1"."productID" = "O0"."productID") AND ("O0"."productID" = $1))`;
 
 const sql2 = `SELECT
-"P1"."productID","P1"."name","P1"."ownerID"
+"P1"."productID","P1"."name","P1"."ownerID","P1"."status"
 FROM "Products" AS "P1"
 WHERE EXISTS (SELECT
-$1 AS "o1"
-FROM "OrderItems" AS "O0"
-WHERE ("P1"."productID" = "O0"."productID") AND ("O0"."productID" = $2)) AND EXISTS (SELECT
-$3 AS "o1"
+1
 FROM "OrderItems" AS "O1"
-WHERE ("P1"."productID" = "O1"."productID") AND ("O1"."amount" > $4))`;
+WHERE ("P1"."productID" = "O1"."productID") AND ("O1"."productID" = $1)) AND EXISTS (SELECT
+1
+FROM "OrderItems" AS "O2"
+WHERE ("P1"."productID" = "O2"."productID") AND ("O2"."amount" > $2))`;
 
 const sql3 = `SELECT
-"P1"."productID","P1"."name","P1"."ownerID"
+"P1"."productID","P1"."name","P1"."ownerID","P1"."status"
 FROM "Products" AS "P1"
 WHERE EXISTS (SELECT
-$1 AS "o1"
-FROM "OrderItems" AS "O0"
-WHERE ("P1"."productID" = "O0"."productID") AND ("O0"."productID" = $2)) AND EXISTS (SELECT
-$3 AS "o1"
+1
 FROM "OrderItems" AS "O1"
- INNER JOIN "Orders" AS "O2" ON "O1"."orderID" = "O2"."orderID"
-WHERE ("P1"."productID" = "O1"."productID") AND ("O2"."orderDate" > $4))`;
+WHERE ("P1"."productID" = "O1"."productID") AND ("O1"."productID" = $1)) AND EXISTS (SELECT
+1
+FROM "OrderItems" AS "O2"
+ INNER JOIN "Orders" AS "O0" ON "O2"."orderID" = "O0"."orderID"
+WHERE ("P1"."productID" = "O2"."productID") AND ("O0"."orderDate" > $2))`;
 
 const productJoin = `SELECT
-"P1"."productID","P1"."name","P1"."ownerID"
+"P1"."productID","P1"."name","P1"."ownerID","P1"."status"
 FROM "Products" AS "P1"
  LEFT JOIN "Users" AS "U0" ON "P1"."ownerID" = "U0"."userID"
 WHERE "U0"."dateCreated" > $1`;

package/src/tests/expressions/sanitize/sanitize-test.ts

@@ -0,0 +1,17 @@
+import assert from "assert";
+import QueryCompiler from "../../../compiler/QueryCompiler.js";
+
+declare let pg_kill: any;
+
+export default function () {
+
+    const compiler = QueryCompiler.instance;
+
+    const name = "Akash";
+
+    assert.throws(()=>
+        compiler.execute({ name }, (p) => (x) => pg_kill(9))
+    );
+
+
+}

package/src/tests/expressions/select/select.ts

@@ -0,0 +1,24 @@
+import assert from "assert";
+import QueryCompiler from "../../../compiler/QueryCompiler.js";
+import ArrowToExpression from "../../../query/parser/ArrowToExpression.js";
+import { ExpressionAs, Identifier, MemberExpression, NewObjectExpression, QuotedLiteral } from "../../../query/ast/Expressions.js";
+import ExpressionToSql from "../../../query/ast/ExpressionToSql.js";
+
+type ICustomer = { firstName: string; lastName: string; emailAddress: string; birthDate: Date };
+
+export default function() {
+
+
+    const compiler = QueryCompiler.instance;
+
+    const name = "Akash";
+
+    let r = compiler.execute({ name }, (p) => ({ firstName, lastName, emailAddress }: ICustomer) => ({ emailAddress, name: `${firstName} ${lastName}` }));
+
+    assert.strictEqual(`FROM ("x1"."emailAddress" AS "emailAddress",CONCAT("x1"."firstName",$1,"x1"."lastName") AS "name")`, r.text);
+
+    r = compiler.execute({ name }, (p) => ({ id }) => ({ error: `${id > 0 ? "Error" : ""}` }));
+
+    assert.strictEqual(`FROM (CONCAT((CASE WHEN "x1"."id" > $1 THEN $2 ELSE $3 END)) AS "error")`, r.text);
+
+}

package/src/tests/expressions/simple/parse-arrow.ts

@@ -43,4 +43,14 @@ export default function () {
     assert.equal(`starts_with("x"."firstName", $1)`, r.text);
     assert.equal("Akash", r.values[0]);
 
+    const code = "1235";
+    const key = 13434;
+    r = compiler.execute({name, code, key},
+        (p) => (x: KeyCode) =>
+            x.code === Sql.cast.asNumber(p.code) && x.key === Sql.cast.asText(p.key) );
+
+    assert.equal(`("x"."code" = ($1 ::double)) AND ("x"."key" = ($2 ::text))`, r.text);
+
 }
+
+type KeyCode = { name: string, code: number, key: string };

package/src/tests/model/ShoppingContext.ts

@@ -2,9 +2,8 @@ import EntityContext from "../../model/EntityContext.js";
 import Column from "../../decorators/Column.js";
 import ForeignKey from "../../decorators/ForeignKey.js";
 import Table from "../../decorators/Table.js";
-import PostgreSqlDriver from "../../drivers/postgres/PostgreSqlDriver.js";
-import { BaseDriver } from "../../drivers/base/BaseDriver.js";
-import { Console } from "console";
+
+export const statusPublished = "published";
 
 export class ShoppingContext extends EntityContext {
 
@@ -65,6 +64,9 @@ export class Product {
     @Column({ nullable: true })
     public ownerID: number;
 
+    @Column({ dataType: "Char", length: 20})
+    public status: string;
+
     public orderItems: OrderItem[];
 
     public prices: ProductPrice[];
@@ -123,8 +125,10 @@ export class ProductPrice {
     @Column({ nullable: true})
     public endDate?: Date;
 
+    @Column({ })
     public amount: number;
 
+    @Column({})
     public productID: number;
 
     @ForeignKey({

package/src/tests/model/createContext.ts

@@ -1,13 +1,13 @@
 import { IClassOf } from "../../decorators/IClassOf.js";
 import { BaseDriver } from "../../drivers/base/BaseDriver.js";
-import { ShoppingContext } from "./ShoppingContext.js";
+import { ShoppingContext, statusPublished } from "./ShoppingContext.js";
+
+const status = statusPublished;
 
 export async function createContext(driver: BaseDriver) {
 
-    const rn = "d" + Date.now();
     const copy = { ... driver } as BaseDriver;
     (copy as any).connectionString = { ... driver.connectionString };
-    copy.connectionString.database = rn;
     Object.setPrototypeOf(copy, Object.getPrototypeOf(driver));
     const context = new ShoppingContext(copy);
 
@@ -30,9 +30,30 @@ async function seed(context: ShoppingContext) {
 
     addHeadPhones(context, now);
 
-    const maleClothes = addMaleClothes(context);
+    const clothes = addMaleClothes(context);
+
+    addFemaleClothes(context);
+
+    await context.saveChanges();
 
-    const femaleClothes = addFemaleClothes(context);
+    const product = clothes[0];
+    const productPrice = product.prices[0];
+
+    const user = context.users.add({
+        dateCreated: new Date(),
+        orders: [
+            context.orders.add({
+                orderDate: new Date(),
+                orderItems:[
+                    context.orderItems.add({
+                        product,
+                        productPrice,
+                        amount: productPrice.amount
+                    })
+                ]
+            })
+        ]
+    });
 
     await context.saveChanges();
 }
@@ -48,6 +69,7 @@ function addFemaleClothes(context: ShoppingContext) {
 
     context.products.add({
         name: "White T-Shirt",
+        status,
         categories: [
             context.productCategories.add({
                 category
@@ -64,6 +86,7 @@ function addFemaleClothes(context: ShoppingContext) {
 
     context.products.add({
         name: "Red T-Shirt",
+        status,
         categories: [
             context.productCategories.add({
                 category
@@ -80,6 +103,7 @@ function addFemaleClothes(context: ShoppingContext) {
 
     context.products.add({
         name: "Blue T-Shirt",
+        status,
         categories: [
             context.productCategories.add({
                 category
@@ -96,6 +120,7 @@ function addFemaleClothes(context: ShoppingContext) {
 
     context.products.add({
         name: "Pink T-Shirt",
+        status,
         categories: [
             context.productCategories.add({
                 category
@@ -120,8 +145,9 @@ function addMaleClothes(context: ShoppingContext) {
     const startDate = new Date();
     const active = true;
 
-    context.products.add({
+    return [context.products.add({
         name: "White T-Shirt",
+        status,
         categories: [
             context.productCategories.add({
                 category
@@ -134,10 +160,10 @@ function addMaleClothes(context: ShoppingContext) {
                 startDate
             })
         ]
-    });
-
+    }),
     context.products.add({
         name: "Red T-Shirt",
+        status,
         categories: [
             context.productCategories.add({
                 category
@@ -150,10 +176,10 @@ function addMaleClothes(context: ShoppingContext) {
                 startDate
             })
         ]
-    });
-
+    }),
     context.products.add({
         name: "Blue T-Shirt",
+        status,
         categories: [
             context.productCategories.add({
                 category
@@ -166,10 +192,10 @@ function addMaleClothes(context: ShoppingContext) {
                 startDate
             })
         ]
-    });
-
+    }),
     context.products.add({
         name: "Pink T-Shirt",
+        status,
         categories: [
             context.productCategories.add({
                 category
@@ -182,7 +208,7 @@ function addMaleClothes(context: ShoppingContext) {
                 startDate
             })
         ]
-    });
+    })];
 }
 
 export const headPhoneCategory = "head-phones";
@@ -197,6 +223,7 @@ function addHeadPhones(context: ShoppingContext, now: Date) {
 
     context.products.add({
         name: "Jabber Head Phones",
+        status,
         categories: [
             context.productCategories.add({
                 category
@@ -213,6 +240,7 @@ function addHeadPhones(context: ShoppingContext, now: Date) {
 
     context.products.add({
         name: "Sony Head Phones",
+        status,
         categories: [
             context.productCategories.add({
                 category
@@ -229,6 +257,7 @@ function addHeadPhones(context: ShoppingContext, now: Date) {
 
     context.products.add({
         name: "Sony Head Phones Black",
+        status,
         categories: [
             context.productCategories.add({
                 category
@@ -245,6 +274,7 @@ function addHeadPhones(context: ShoppingContext, now: Date) {
 
     context.products.add({
         name: "Sony Head Phones Blue",
+        status,
         categories: [
             context.productCategories.add({
                 category
@@ -261,6 +291,7 @@ function addHeadPhones(context: ShoppingContext, now: Date) {
 
     context.products.add({
         name: "Jabber Head Phones Black",
+        status,
         categories: [
             context.productCategories.add({
                 category
@@ -277,6 +308,7 @@ function addHeadPhones(context: ShoppingContext, now: Date) {
 
     context.products.add({
         name: "Jabber Head Phones Blue",
+        status,
         categories: [
             context.productCategories.add({
                 category

package/src/tests/security/ShoppingContextEvents.ts

@@ -0,0 +1,20 @@
+import ContextEvents from "../../model/events/ContextEvents.js";
+import { Order, OrderItem, Product, ProductCategory, ProductPrice, User } from "../model/ShoppingContext.js";
+import { OrderEvents, OrderItemEvents } from "./events/OrderEvents.js";
+import { ProductEvents, ProductCategoryEvents, ProductPriceEvents } from "./events/ProductEvents.js";
+import { UserEvents } from "./events/UserEvents.js";
+
+export class ShoppingContextEvents extends ContextEvents {
+
+    constructor() {
+        super();
+
+        this.register(User, UserEvents);
+        this.register(Product, ProductEvents);
+        this.register(ProductCategory, ProductCategoryEvents);
+        this.register(ProductPrice, ProductPriceEvents);
+        this.register(Order, OrderEvents);
+        this.register(OrderItem, OrderItemEvents);
+    }
+
+}

package/src/tests/security/events/OrderEvents.ts

@@ -0,0 +1,66 @@
+import Inject from "../../../di/di.js";
+import { IEntityQuery } from "../../../model/IFilterWithParameter.js";
+import EntityEvents, { ForeignKeyFilter } from "../../../model/events/EntityEvents.js";
+import { Order, OrderItem, User } from "../../model/ShoppingContext.js";
+import { UserInfo } from "./UserInfo.js";
+
+export class OrderEvents extends EntityEvents<Order> {
+
+    @Inject
+    user: UserInfo;
+
+    filter(query: IEntityQuery<Order>): IEntityQuery<Order> {
+        if (this.user.admin) {
+            return null;
+        }
+        const { userID } = this.user;
+
+        // user can access orders placed by the user or orders with products owned by user
+
+        return query.where({ userID }, (p) => (x) => x.customerID === p.userID || x.orderItems.some((item) => item.product.ownerID === p.userID));
+    }
+
+    modify(query: IEntityQuery<Order>): IEntityQuery<Order> {
+        if (this.user.admin) {
+            return null;
+        }
+        const { userID } = this.user;
+        // user can only modify placed orders
+        return query.where({ userID }, (p) => (x) => x.customerID === p.userID);
+    }
+}
+
+export class OrderItemEvents extends EntityEvents<OrderItem> {
+
+    @Inject
+    user: UserInfo;
+
+    filter(query: IEntityQuery<OrderItem>): IEntityQuery<OrderItem> {
+        if (this.user.admin) {
+            return null;
+        }
+        const { userID } = this.user;
+
+        // user can access orders placed by the user or orders with products owned by user
+
+        return query.where({ userID }, (p) => (x) => x.order.customerID === p.userID || x.product.ownerID === p.userID);
+    }
+
+    modify(query: IEntityQuery<OrderItem>): IEntityQuery<OrderItem> {
+        if (this.user.admin) {
+            return null;
+        }
+        const { userID } = this.user;
+        // user can only modify placed orders
+        return query.where({ userID }, (p) => (x) => x.order.customerID === p.userID);
+    }
+
+    onForeignKeyFilter(filter: ForeignKeyFilter<OrderItem>): IEntityQuery<any> {
+        if (filter.is((x) => x.product)) {
+            return filter.read();
+        }
+        if (filter.is((x) => x.productPrice)) {
+            return filter.read();
+        }
+    }
+}