@getstrata/core 0.3.9 → 0.4.0

package/dist/core/database/boundConnection.d.ts

@@ -0,0 +1,5 @@
+import type { DatabaseConnection } from "./baseRepository";
+declare function bindDatabaseConnection(connection: DatabaseConnection): void;
+declare function getBoundDatabaseConnection(): DatabaseConnection | null;
+declare function resetBoundDatabaseConnection(): void;
+export { bindDatabaseConnection, getBoundDatabaseConnection, resetBoundDatabaseConnection };

package/dist/core/database/query.d.ts

@@ -24,6 +24,7 @@ declare function buildProjectionQuery<TEntity>(table: TableDefinition<TEntity>,
     text: string;
     params: unknown[];
 };
+declare function assertSafeProjectionExpression(expression: string): void;
 declare function buildGroupedCountQuery<TEntity, K extends keyof TEntity & string>(table: TableDefinition<TEntity>, column: K, where?: QueryWhere<TEntity>, options?: Pick<QueryOptions<TEntity>, "withTrashed" | "onlyTrashed">): {
     text: string;
     params: unknown[];
@@ -48,4 +49,4 @@ declare function buildDeleteByIdQuery<TEntity, PrimaryKey extends keyof TEntity
     text: string;
     params: unknown[];
 };
-export { buildCountQuery, buildDeleteByIdQuery, buildGroupedCountQuery, buildInsertQuery, buildOrderByClause, buildProjectionQuery, buildQueryWhereClause, buildRestoreByIdQuery, buildSelectQuery, buildSoftDeleteByIdQuery, buildUpdateQuery, buildWhereClause, qualifyColumn, quoteIdentifier, resolveSoftDeleteColumn, };
+export { assertSafeProjectionExpression, buildCountQuery, buildDeleteByIdQuery, buildGroupedCountQuery, buildInsertQuery, buildOrderByClause, buildProjectionQuery, buildQueryWhereClause, buildRestoreByIdQuery, buildSelectQuery, buildSoftDeleteByIdQuery, buildUpdateQuery, buildWhereClause, qualifyColumn, quoteIdentifier, resolveSoftDeleteColumn, };

package/dist/core/database/repositoryConnection.d.ts

@@ -0,0 +1,4 @@
+import type { DatabaseConnection } from "./baseRepository";
+declare function resolveRepositoryConnection(): DatabaseConnection;
+declare const repositoryConnection: DatabaseConnection;
+export { repositoryConnection, resolveRepositoryConnection };

package/dist/index.js

@@ -157,6 +157,15 @@ class Policy {
     return false;
   }
 }
+var BLOCKED_POLICY_ACTIONS = new Set([
+  "constructor",
+  "toString",
+  "valueOf",
+  "hasOwnProperty",
+  "isPrototypeOf",
+  "propertyIsEnumerable",
+  "__proto__"
+]);
 
 class PolicyGate {
   constructor() {}
@@ -169,6 +178,9 @@ class PolicyGate {
     if (!policy) {
       return false;
     }
+    if (BLOCKED_POLICY_ACTIONS.has(action) || !(action in policy)) {
+      return false;
+    }
     const handler = policy[action];
     if (typeof handler !== "function") {
       return false;
@@ -248,76 +260,6 @@ var CACHE_TAGS = {
   attachments: "attachments",
   reports: "reports"
 };
-// ../../src/config/database.ts
-function readInteger(name, fallback) {
-  const parsed = Number.parseInt(process.env[name] ?? String(fallback), 10);
-  return Number.isInteger(parsed) && parsed >= 0 ? parsed : fallback;
-}
-var databaseConfig = {
-  url: process.env.DATABASE_URL ?? "",
-  poolMax: readInteger("DB_POOL_MAX", 10),
-  idleTimeoutSeconds: readInteger("DB_POOL_IDLE_TIMEOUT", 30),
-  maxLifetimeSeconds: readInteger("DB_POOL_MAX_LIFETIME", 3600),
-  connectionTimeoutSeconds: readInteger("DB_CONNECTION_TIMEOUT", 10)
-};
-
-// ../../src/core/database/connectionContext.ts
-import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
-var activeConnection = new AsyncLocalStorage2;
-function getActiveDatabaseConnection(fallback) {
-  return activeConnection.getStore() ?? fallback;
-}
-
-// ../../src/db/connection/createConnection.ts
-var {SQL } = globalThis.Bun;
-function createDatabaseConnection(config) {
-  if (!config.url) {
-    throw new Error("DATABASE_URL is not configured. Set DATABASE_URL before starting the app or running integration tests.");
-  }
-  return new SQL({
-    url: config.url,
-    max: config.poolMax,
-    idleTimeout: config.idleTimeoutSeconds,
-    maxLifetime: config.maxLifetimeSeconds,
-    connectionTimeout: config.connectionTimeoutSeconds
-  });
-}
-
-// ../../src/db/connection/index.ts
-var connectionHolder = {
-  connection: null
-};
-function getDatabase() {
-  if (!connectionHolder.connection) {
-    connectionHolder.connection = createDatabaseConnection(databaseConfig);
-  }
-  return connectionHolder.connection;
-}
-function resetDatabaseConnectionForTests(connection) {
-  connectionHolder.connection = connection;
-}
-var POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
-function resolveDatabase() {
-  return getActiveDatabaseConnection(getDatabase());
-}
-function resolveDatabaseForProperty(property) {
-  if (typeof property === "string" && POOL_CONNECTION_METHODS.has(property)) {
-    return getDatabase();
-  }
-  return resolveDatabase();
-}
-var db = new Proxy(function database() {}, {
-  apply(_target, _thisArg, args) {
-    return resolveDatabase()(...args);
-  },
-  get(_target, property) {
-    const connection = resolveDatabaseForProperty(property);
-    const value = connection[property];
-    return typeof value === "function" ? value.bind(connection) : value;
-  }
-});
-var connection_default = db;
-
 // ../../src/core/events/eventBus.ts
 class EventBus {
   constructor() {}
@@ -617,6 +559,7 @@ function buildCountQuery(table, where = {}, options = {}) {
   };
 }
 function buildProjectionQuery(table, expression, alias, options = {}) {
+  assertSafeProjectionExpression(expression);
   const { clause, params } = buildQueryWhereClause(table, options);
   const orderBy = buildOrderByClause(table.name, options.orderBy);
   const limit = buildLimitClause(options.limit);
@@ -625,6 +568,12 @@ function buildProjectionQuery(table, expression, alias, options = {}) {
     params
   };
 }
+var SAFE_PROJECTION_EXPRESSION = /^(COUNT\(\*\)|(?:"[\w_]+"(?:\."[\w_]+")?)|(?:AVG|SUM|MIN|MAX)\((?:"[\w_]+"(?:\."[\w_]+")?)\))$/;
+function assertSafeProjectionExpression(expression) {
+  if (!SAFE_PROJECTION_EXPRESSION.test(expression.trim())) {
+    throw new Error(`Unsafe projection expression: ${expression}`);
+  }
+}
 function buildGroupedCountQuery(table, column, where = {}, options = {}) {
   const qualifiedColumn = qualifyColumn(table.name, column);
   const { clause, params } = buildQueryWhereClause(table, {
@@ -745,6 +694,96 @@ function indexBelongsToRelation(children, parents, relation) {
   return result;
 }
 
+// ../../src/config/database.ts
+function readInteger(name, fallback) {
+  const parsed = Number.parseInt(process.env[name] ?? String(fallback), 10);
+  return Number.isInteger(parsed) && parsed >= 0 ? parsed : fallback;
+}
+var databaseConfig = {
+  url: process.env.DATABASE_URL ?? "",
+  poolMax: readInteger("DB_POOL_MAX", 10),
+  idleTimeoutSeconds: readInteger("DB_POOL_IDLE_TIMEOUT", 30),
+  maxLifetimeSeconds: readInteger("DB_POOL_MAX_LIFETIME", 3600),
+  connectionTimeoutSeconds: readInteger("DB_CONNECTION_TIMEOUT", 10)
+};
+
+// ../../src/core/database/connectionContext.ts
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
+var activeConnection = new AsyncLocalStorage2;
+function getActiveDatabaseConnection(fallback) {
+  return activeConnection.getStore() ?? fallback;
+}
+
+// ../../src/db/connection/createConnection.ts
+var {SQL } = globalThis.Bun;
+function createDatabaseConnection(config) {
+  if (!config.url) {
+    throw new Error("DATABASE_URL is not configured. Set DATABASE_URL before starting the app or running integration tests.");
+  }
+  return new SQL({
+    url: config.url,
+    max: config.poolMax,
+    idleTimeout: config.idleTimeoutSeconds,
+    maxLifetime: config.maxLifetimeSeconds,
+    connectionTimeout: config.connectionTimeoutSeconds
+  });
+}
+
+// ../../src/db/connection/index.ts
+var connectionHolder = {
+  connection: null
+};
+function getDatabase() {
+  if (!connectionHolder.connection) {
+    connectionHolder.connection = createDatabaseConnection(databaseConfig);
+  }
+  return connectionHolder.connection;
+}
+var POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
+function resolveDatabase() {
+  return getActiveDatabaseConnection(getDatabase());
+}
+function resolveDatabaseForProperty(property) {
+  if (typeof property === "string" && POOL_CONNECTION_METHODS.has(property)) {
+    return getDatabase();
+  }
+  return resolveDatabase();
+}
+var db = new Proxy(function database() {}, {
+  apply(_target, _thisArg, args) {
+    return resolveDatabase()(...args);
+  },
+  get(_target, property) {
+    const connection = resolveDatabaseForProperty(property);
+    const value = connection[property];
+    return typeof value === "function" ? value.bind(connection) : value;
+  }
+});
+var connection_default = db;
+
+// ../../src/core/database/boundConnection.ts
+var boundConnectionHolder = {
+  connection: null
+};
+function bindDatabaseConnection(connection) {
+  boundConnectionHolder.connection = connection;
+}
+function getBoundDatabaseConnection() {
+  return boundConnectionHolder.connection;
+}
+
+// ../../src/core/database/repositoryConnection.ts
+function resolveRepositoryConnection() {
+  return getBoundDatabaseConnection() ?? connection_default;
+}
+var repositoryConnection = new Proxy({}, {
+  get(_target, property) {
+    const connection = resolveRepositoryConnection();
+    const value = connection[property];
+    return typeof value === "function" ? value.bind(connection) : value;
+  }
+});
+
 // ../../src/core/database/repositoryQuery.ts
 class RepositoryQuery {
   repository;
@@ -829,7 +868,7 @@ class RepositoryQuery {
 class BaseRepository {
   table;
   connection;
-  constructor(table, connection = connection_default) {
+  constructor(table, connection = repositoryConnection) {
     this.table = table;
     this.connection = connection;
   }
@@ -1028,8 +1067,8 @@ class BaseRepository {
 }
 var baseRepository_default = BaseRepository;
 // ../../src/core/database/bindConnection.ts
-function bindDatabaseConnection(connection) {
-  resetDatabaseConnectionForTests(connection);
+function bindDatabaseConnection2(connection) {
+  bindDatabaseConnection(connection);
 }
 // ../../src/core/database/migrations/runner.ts
 import { readdir } from "fs/promises";
@@ -1055,7 +1094,7 @@ async function getAppliedMigrations(db2) {
 }
 async function loadMigrationsFromDirectory(directory) {
   const entries = await readdir(directory);
-  const migrationFiles = entries.filter((entry) => entry.endsWith(".ts") && entry !== "types.ts" && entry !== "index.ts" && entry !== "runner.ts").sort();
+  const migrationFiles = entries.filter((entry) => (entry.endsWith(".ts") || entry.endsWith(".js")) && entry !== "types.ts" && entry !== "index.ts" && entry !== "runner.ts").sort();
   const loadedMigrations = await Promise.all(migrationFiles.map(async (fileName) => {
     const moduleUrl = pathToFileURL(join(directory, fileName)).href;
     const module = await import(moduleUrl);
@@ -1080,7 +1119,10 @@ async function migrateDatabase(db2, migrations, options = {}) {
   for (const migration of pendingMigrations) {
     options.onMigration?.(migration.name);
     await migration.up(db2);
-    await db2.unsafe(`INSERT INTO ${MIGRATIONS_TABLE} (name, batch) VALUES ($1, $2) ON CONFLICT (name) DO NOTHING`, [migration.name, nextBatch]);
+    const inserted = await db2.unsafe(`INSERT INTO ${MIGRATIONS_TABLE} (name, batch) VALUES ($1, $2) ON CONFLICT (name) DO NOTHING RETURNING name`, [migration.name, nextBatch]);
+    if (inserted.length === 0) {
+      throw new Error(`Migration ${migration.name} was applied but not recorded.`);
+    }
   }
   return pendingMigrations.length;
 }
@@ -2532,7 +2574,7 @@ export {
   createMetricsMiddleware,
   config,
   cache,
-  bindDatabaseConnection,
+  bindDatabaseConnection2 as bindDatabaseConnection,
   belongsTo,
   auth,
   assertIfMatch,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/core",
-  "version": "0.3.9",
+  "version": "0.4.0",
   "description": "Strata — Laravel-inspired Bun framework public API",
   "type": "module",
   "license": "MIT",