@graphoria/server 0.1.0

package/src/databases/core/executor.ts

@@ -0,0 +1,97 @@
+import type { VariableDefinition } from "../../analyzeQuery/types";
+import type { Database } from "../../types/configuration";
+import type { ProcedureResolver } from "../../types/db";
+
+import { databaseAdapters } from "./function-mapping";
+import { logger } from "../../logging";
+
+/**
+ * Core database execution functions
+ */
+
+export const executeQuery = async <T>(
+  query: string,
+  db: Database,
+  variablesDefinition: VariableDefinition[],
+  variables: Record<string, unknown>,
+) => {
+  const adapter = databaseAdapters[db?.type];
+  if (!adapter) {
+    throw new Error(`Unsupported database type: ${db?.type}`);
+  }
+
+  const log = logger("db").child({ dbType: db.type, dbName: db.name });
+  const startTime = Bun.nanoseconds();
+
+  try {
+    const result = await adapter.execute<T>(query, db, variablesDefinition, variables);
+    log.debug(
+      { durationMs: (Bun.nanoseconds() - startTime) / 1e6, queryLength: query.length },
+      "query executed",
+    );
+    return result;
+  } catch (error) {
+    log.error({ err: error, durationMs: (Bun.nanoseconds() - startTime) / 1e6 }, "query failed");
+    throw error;
+  }
+};
+
+export const executeQueryJSON = async <T>(
+  query: string,
+  db: Database,
+  variablesDefinition: VariableDefinition[],
+  variables: Record<string, unknown>,
+) => {
+  const adapter = databaseAdapters[db.type];
+  if (!adapter) {
+    throw new Error(`Unsupported database type: ${db.type}`);
+  }
+
+  const log = logger("db").child({ dbType: db.type, dbName: db.name });
+  const startTime = Bun.nanoseconds();
+
+  try {
+    const result = await adapter.executeJson<T>(query, db, variablesDefinition, variables);
+    log.debug(
+      { durationMs: (Bun.nanoseconds() - startTime) / 1e6, queryLength: query.length },
+      "query executed (json)",
+    );
+    return result;
+  } catch (error) {
+    log.error(
+      { err: error, durationMs: (Bun.nanoseconds() - startTime) / 1e6 },
+      "query failed (json)",
+    );
+    throw error;
+  }
+};
+
+export const callStoredProcedure = async (
+  sp: ProcedureResolver,
+  variablesDefinition: VariableDefinition[],
+  variables: Record<string, unknown> = {},
+) => {
+  const adapter = databaseAdapters[sp.db!.type];
+  if (!adapter) {
+    throw new Error(`Unsupported database type: ${sp.db!.type}`);
+  }
+
+  const log = logger("db").child({
+    dbType: sp.db!.type,
+    dbName: sp.db!.name,
+    procedure: sp.dottedName,
+  });
+  const startTime = Bun.nanoseconds();
+
+  try {
+    const result = await adapter.callStoredProcedure(sp, variablesDefinition, variables);
+    log.debug({ durationMs: (Bun.nanoseconds() - startTime) / 1e6 }, "stored procedure executed");
+    return result;
+  } catch (error) {
+    log.error(
+      { err: error, durationMs: (Bun.nanoseconds() - startTime) / 1e6 },
+      "stored procedure failed",
+    );
+    throw error;
+  }
+};

package/src/databases/core/function-mapping.ts

@@ -0,0 +1,176 @@
+import type { OperationAnalysis, VariableDefinition } from "../../analyzeQuery/types";
+import type { MergedEntities } from "../../configuration/getSchemas/mergeEntities";
+import type { Auth, Database, DatabaseType } from "../../types/configuration";
+import type { DatabaseStructure, ProcedureResolver, TableResolver, View } from "../../types/db";
+import type { GenerateCreateTableSQLParameters } from "../schemaBuilder/generateCreateTable";
+
+import {
+  checkUserCredentials as checkUserCredentialsMSSQL,
+  createAuthTables as createAuthTablesMSSQL,
+  insertAuthUser as insertAuthUserMSSQL,
+  verifyAuthTablesExist as verifyAuthTablesExistMSSQL,
+} from "../engines/mssql/auth";
+import {
+  callStoredProcedure as callStoredProcedureMSSQL,
+  executeQueryJSON as executeQueryJsonMSSQL,
+  executeQuery as executeQueryMSSQL,
+} from "../engines/mssql/connection";
+import { format as formatMSSQL } from "../engines/mssql/format";
+import { getDatabaseStructure as getStructureMSSQL } from "../engines/mssql/getStructure";
+import { getViewsFromDB as viewMSSQL } from "../engines/mssql/getViews";
+import { generateSQL as queryMssql } from "../engines/mssql/query";
+import {
+  checkUserCredentials as checkUserCredentialsMySQL,
+  createAuthTables as createAuthTablesMySQL,
+  insertAuthUser as insertAuthUserMySQL,
+  verifyAuthTablesExist as verifyAuthTablesExistMySQL,
+} from "../engines/mysql/auth";
+import {
+  callStoredProcedure as callStoredProcedureMySQL,
+  executeQueryJSON as executeQueryJsonMySQL,
+  executeQuery as executeQueryMySQL,
+} from "../engines/mysql/connection";
+import { format as formatMySQL } from "../engines/mysql/format";
+import { getDatabaseStructure as getStructureMySQL } from "../engines/mysql/getStructure";
+import { getViewsFromDB as viewMySQL } from "../engines/mysql/getViews";
+import { generateSQL as queryMySQL } from "../engines/mysql/query";
+import {
+  checkUserCredentials as checkUserCredentialsPostgreSQL,
+  createAuthTables as createAuthTablesPostgreSQL,
+  insertAuthUser as insertAuthUserPostgreSQL,
+  verifyAuthTablesExist as verifyAuthTablesExistPostgreSQL,
+} from "../engines/postgresql/auth";
+import {
+  callStoredProcedure as callStoredProcedurePostgreSQL,
+  executeQueryJSON as executeQueryJsonPostgreSQL,
+  executeQuery as executeQueryPostgreSQL,
+} from "../engines/postgresql/connection";
+import { format as formatPostgreSQL } from "../engines/postgresql/format";
+import { getDatabaseStructure as getStructurePostgreSQL } from "../engines/postgresql/getStructure";
+import { getViewsFromDB as viewPostgreSQL } from "../engines/postgresql/getViews";
+import { generateSQL as queryPostgreSQL } from "../engines/postgresql/query";
+import {
+  generateCreateTableMSSQL,
+  generateCreateTableMySQL,
+  generateCreateTablePostgreSQL,
+} from "../schemaBuilder/generateCreateTable";
+import {
+  generateInsertSQLMSSQL,
+  generateInsertSQLMySQL,
+  generateInsertSQLPostgreSQL,
+} from "../schemaBuilder/generateInsert";
+
+export type CheckUserCredentialsResult =
+  | {
+      valid: false;
+      role: null;
+      claims: null;
+    }
+  | {
+      valid: true;
+      role: string;
+      claims: Record<string, unknown>;
+    };
+
+export type InsertAuthUserInput = {
+  username: string;
+  password: string;
+  role: string;
+  claims?: Record<string, unknown>;
+};
+
+type DatabaseFunctions = {
+  query: (
+    entities: MergedEntities,
+    operation: OperationAnalysis,
+    variables: Record<string, unknown>,
+    forHashMethod: boolean,
+  ) => string;
+  execute: <T>(
+    query: string,
+    db: Database,
+    variablesDefinition: VariableDefinition[],
+    values: Record<string, unknown>,
+  ) => Promise<T[]>;
+  executeJson: <T>(
+    query: string,
+    db: Database,
+    variablesDefinition: VariableDefinition[],
+    values: Record<string, unknown>,
+  ) => Promise<T>;
+  callStoredProcedure: (
+    sp: ProcedureResolver,
+    variablesDefinition: VariableDefinition[],
+    parameters: Record<string, unknown>,
+    // oxlint-disable-next-line typescript/no-explicit-any
+  ) => Promise<any>;
+  getDatabaseStructure: (db: Database) => Promise<DatabaseStructure>;
+  getViews: (db: Database) => Promise<View[]>;
+  format: (data: string) => string;
+  generateInsertSQL: (
+    table: TableResolver,
+    // oxlint-disable-next-line typescript/no-explicit-any
+    data: Record<string, any>[],
+  ) => string;
+  generateCreateTableSQL: (
+    table: TableResolver,
+    params: GenerateCreateTableSQLParameters,
+  ) => string;
+  createAuthTables: (auth: Auth) => Promise<void>;
+  checkUserCredentials: (
+    db: Database,
+    auth: Auth,
+    username: string,
+    password: string,
+  ) => Promise<CheckUserCredentialsResult>;
+  insertAuthUser: (auth: Auth, input: InsertAuthUserInput) => Promise<void>;
+  verifyAuthTablesExist: (auth: Auth) => Promise<void>;
+};
+
+export const databaseAdapters: Record<DatabaseType, DatabaseFunctions> = {
+  mssql: {
+    query: queryMssql,
+    callStoredProcedure: callStoredProcedureMSSQL,
+    executeJson: executeQueryJsonMSSQL,
+    execute: executeQueryMSSQL,
+    getDatabaseStructure: getStructureMSSQL,
+    getViews: viewMSSQL,
+    format: formatMSSQL,
+    generateInsertSQL: generateInsertSQLMSSQL,
+    generateCreateTableSQL: generateCreateTableMSSQL,
+    createAuthTables: createAuthTablesMSSQL,
+    checkUserCredentials: checkUserCredentialsMSSQL,
+    insertAuthUser: insertAuthUserMSSQL,
+    verifyAuthTablesExist: verifyAuthTablesExistMSSQL,
+  },
+  pg: {
+    query: queryPostgreSQL,
+    callStoredProcedure: callStoredProcedurePostgreSQL,
+    executeJson: executeQueryJsonPostgreSQL,
+    execute: executeQueryPostgreSQL,
+    getDatabaseStructure: getStructurePostgreSQL,
+    getViews: viewPostgreSQL,
+    format: formatPostgreSQL,
+    generateInsertSQL: generateInsertSQLPostgreSQL,
+    generateCreateTableSQL: generateCreateTablePostgreSQL,
+    createAuthTables: createAuthTablesPostgreSQL,
+    checkUserCredentials: checkUserCredentialsPostgreSQL,
+    insertAuthUser: insertAuthUserPostgreSQL,
+    verifyAuthTablesExist: verifyAuthTablesExistPostgreSQL,
+  },
+  mysql: {
+    query: queryMySQL,
+    callStoredProcedure: callStoredProcedureMySQL,
+    executeJson: executeQueryJsonMySQL,
+    execute: executeQueryMySQL,
+    getDatabaseStructure: getStructureMySQL,
+    getViews: viewMySQL,
+    format: formatMySQL,
+    generateInsertSQL: generateInsertSQLMySQL,
+    generateCreateTableSQL: generateCreateTableMySQL,
+    createAuthTables: createAuthTablesMySQL,
+    checkUserCredentials: checkUserCredentialsMySQL,
+    insertAuthUser: insertAuthUserMySQL,
+    verifyAuthTablesExist: verifyAuthTablesExistMySQL,
+  },
+} as const;

package/src/databases/core/identifier.ts

@@ -0,0 +1,8 @@
+const IDENTIFIER_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+
+export const assertSafeIdentifier = (identifier: string, label = "identifier"): string => {
+  if (!IDENTIFIER_PATTERN.test(identifier)) {
+    throw new Error(`Invalid ${label}: ${identifier}`);
+  }
+  return identifier;
+};

package/src/databases/core/query-builder.ts

@@ -0,0 +1,47 @@
+import type { AnalysisResult, SelectionAnalysis } from "../../analyzeQuery/types";
+import type { MergedEntities } from "../../configuration/getSchemas/mergeEntities";
+import type { Database } from "../../types/configuration";
+
+import { databaseAdapters } from "./function-mapping";
+
+export const generateSQL = (
+  entities: MergedEntities,
+  analysisResult: AnalysisResult,
+  variables: Record<string, unknown> = {},
+  forHashMethod: boolean = false,
+) => {
+  const operation = analysisResult.operations[0];
+
+  return operation.fields
+    .reduce<[Database, SelectionAnalysis[]][]>((acc, field) => {
+      const tableObj = entities.queriesMap[field.name]!;
+
+      const dbFound = acc.find((a) => a[0].name === tableObj.db?.name);
+
+      if (dbFound) {
+        dbFound[1].push(field);
+      } else {
+        acc.push([tableObj.db!, [field]]);
+      }
+
+      return acc;
+    }, [])
+    .map(([db, fields]) => {
+      const adapter = databaseAdapters[db.type];
+      if (!adapter) {
+        throw new Error(`Unsupported database type: ${db.type}`);
+      }
+
+      const query = adapter.query(
+        entities,
+        {
+          ...operation,
+          fields,
+        },
+        variables,
+        forHashMethod,
+      );
+
+      return [db, query] as const;
+    });
+};

package/src/databases/directives.ts

@@ -0,0 +1,112 @@
+import type { DatabaseType } from "../types/configuration";
+import type { VariableDefinition } from "../analyzeQuery/types";
+
+import { isString } from "es-toolkit/compat";
+
+// Directive handler type
+export type DirectiveHandler = (
+  querySelector: string,
+  directive: { name: string; arguments?: Record<string, unknown> },
+  dbType: DatabaseType,
+) => string;
+
+// Wrap a value in SQL string quotes unless it's a positional placeholder ($1, @1, etc.)
+const sqlString = (value: unknown): string => {
+  const s = String(value);
+  if (/^[$@]\d+$/.test(s)) return s;
+  return `'${s}'`;
+};
+
+// Directive handlers registry
+export const DIRECTIVE_HANDLERS: Record<string, DirectiveHandler> = {
+  uppercase: (querySelector) => `UPPER(${querySelector})`,
+  lowercase: (querySelector) => `LOWER(${querySelector})`,
+  truncate: (querySelector, directive) =>
+    `LEFT(${querySelector}, ${directive.arguments!["length"]})`,
+  default: (querySelector, directive) =>
+    `COALESCE(${querySelector}, ${sqlString(directive.arguments?.["value"] ?? "N/A")})`,
+  trim: (querySelector) => `TRIM(${querySelector})`,
+  ltrim: (querySelector) => `LTRIM(${querySelector})`,
+  rtrim: (querySelector) => `RTRIM(${querySelector})`,
+  substring: (querySelector, directive) =>
+    `SUBSTRING(${querySelector}, ${directive.arguments!["start"]}, ${directive.arguments!["length"]})`,
+  replace: (querySelector, directive) =>
+    `REPLACE(${querySelector}, ${sqlString(directive.arguments!["find"])}, ${sqlString(directive.arguments!["replaceWith"])})`,
+  concat: (querySelector, directive) => {
+    const withValue = directive.arguments!["with"] as string;
+    const position = (directive.arguments?.["position"] as string) ?? "after";
+    return position === "before"
+      ? `CONCAT(${sqlString(withValue)}, ${querySelector})`
+      : `CONCAT(${querySelector}, ${sqlString(withValue)})`;
+  },
+  pad: (querySelector, directive, dbType) => {
+    const length = directive.arguments!["length"] as number;
+    const char = sqlString(directive.arguments?.["char"] ?? " ");
+    const side = (directive.arguments?.["side"] as string) ?? "left";
+    if (dbType === "pg") {
+      return side === "left"
+        ? `LPAD(${querySelector}::TEXT, ${length}, ${char})`
+        : `RPAD(${querySelector}::TEXT, ${length}, ${char})`;
+    } else {
+      return side === "left"
+        ? `RIGHT(REPLICATE(${char}, ${length}) + CAST(${querySelector} AS VARCHAR(MAX)), ${length})`
+        : `LEFT(CAST(${querySelector} AS VARCHAR(MAX)) + REPLICATE(${char}, ${length}), ${length})`;
+    }
+  },
+  dateFormat: (querySelector, directive, dbType) => {
+    const format = directive.arguments!["format"] as string;
+    return dbType === "pg"
+      ? `TO_CHAR(${querySelector}, ${sqlString(format)})`
+      : `FORMAT(${querySelector}, ${sqlString(format)})`;
+  },
+  round: (querySelector, directive) =>
+    `ROUND(${querySelector}, ${(directive.arguments?.["decimals"] as number) ?? 0})`,
+  ceil: (querySelector, directive, dbType) =>
+    dbType === "pg" ? `CEIL(${querySelector})` : `CEILING(${querySelector})`,
+  floor: (querySelector) => `FLOOR(${querySelector})`,
+  abs: (querySelector) => `ABS(${querySelector})`,
+  multiply: (querySelector, directive) => `(${querySelector} * ${directive.arguments!["by"]})`,
+  divide: (querySelector, directive) => `(${querySelector} / ${directive.arguments!["by"]})`,
+};
+
+const mappingDbTypeCharVar: Record<DatabaseType, string> = {
+  pg: "$",
+  mysql: "$",
+  mssql: "@",
+};
+
+/**
+ * Apply a chain of directives to a query selector.
+ * Resolves $name variable refs to positional placeholders before invoking each handler.
+ */
+export const applyDirectives = (
+  querySelector: string,
+  directives: { name: string; arguments?: Record<string, unknown> }[] | undefined,
+  dbType: DatabaseType,
+  variablesDefinition: VariableDefinition[] = [],
+): string => {
+  if (!directives?.length) return querySelector;
+
+  return directives.reduce((query, directive) => {
+    const handler = DIRECTIVE_HANDLERS[directive.name];
+    if (!handler) return query;
+
+    // Resolve $name refs (both $static_N and user $var) to positional placeholders
+    const resolvedArgs =
+      directive.arguments &&
+      Object.fromEntries(
+        Object.entries(directive.arguments).map(([key, value]) => {
+          if (isString(value) && (value as string).startsWith("$")) {
+            const varName = (value as string).substring(1);
+            const index = variablesDefinition.findIndex((v) => v.name === varName);
+            if (index >= 0) {
+              return [key, `${mappingDbTypeCharVar[dbType]}${index + 1}`];
+            }
+          }
+          return [key, value];
+        }),
+      );
+
+    return handler(query, { ...directive, arguments: resolvedArgs }, dbType);
+  }, querySelector);
+};

package/src/databases/engines/mssql/auth.ts

@@ -0,0 +1,112 @@
+import { Bit, MAX, NVarChar } from "mssql";
+
+import type { ConnectionPool } from "mssql";
+import type { Auth, Database } from "../../../types/configuration";
+import type { CheckUserCredentialsResult, InsertAuthUserInput } from "../../core/function-mapping";
+
+import { databasesConnections } from "../../../singletons/databases";
+import { hashPassword, verifyPassword } from "../../auth/password";
+import { assertSafeIdentifier } from "../../core/identifier";
+import { generateSchemaCreationMSSQL } from "../../schemaBuilder/generateSchemaCreation";
+import { parseUserClaims } from "../shared/claims";
+
+export const userTableCreation = (schema: string) => `
+    IF NOT EXISTS (SELECT * FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA = '${assertSafeIdentifier(schema, "schema")}' AND TABLE_NAME = 'user')
+    BEGIN
+        CREATE TABLE ${schema}.[user] (
+            username NVARCHAR(50) PRIMARY KEY,
+            password NVARCHAR(255) NOT NULL,
+            role NVARCHAR(20) NOT NULL,
+            is_active BIT DEFAULT 1,
+            claims NVARCHAR(MAX) DEFAULT '{}',
+        );
+    END
+`;
+
+export const createAuthTables = async (auth: Auth) => {
+  const pool = databasesConnections[auth.databaseEntity.name] as ConnectionPool;
+
+  await pool.query(generateSchemaCreationMSSQL(auth.schema!, true));
+
+  await pool.query(userTableCreation(auth.schema!));
+};
+
+export const checkUserCredentials = async (
+  db: Database,
+  auth: Auth,
+  username: string,
+  password: string,
+  injectedPool?: ConnectionPool,
+): Promise<CheckUserCredentialsResult> => {
+  const pool = injectedPool ?? (databasesConnections[db.name] as ConnectionPool);
+
+  const schema = assertSafeIdentifier(auth.schema!, "schema");
+
+  const request = pool.request().input("username", NVarChar(50), username);
+
+  const result = await request.query(
+    `SELECT * FROM ${schema}.[user] WHERE username = @username AND is_active = 1`,
+  );
+
+  if (result.recordset?.length === 0) {
+    return {
+      valid: false,
+      role: null,
+      claims: null,
+    };
+  }
+
+  const { password: hashedPassword, role, claims } = result.recordset[0];
+
+  if (!(await verifyPassword(password, hashedPassword))) {
+    return {
+      valid: false,
+      role: null,
+      claims: null,
+    };
+  }
+
+  const parsedClaims = parseUserClaims(claims);
+
+  if (parsedClaims === null) {
+    return {
+      valid: false,
+      role: null,
+      claims: null,
+    };
+  }
+
+  return { valid: true, role, claims: parsedClaims };
+};
+
+export const verifyAuthTablesExist = async (
+  auth: Auth,
+  injectedPool?: ConnectionPool,
+): Promise<void> => {
+  const pool = injectedPool ?? (databasesConnections[auth.databaseEntity.name] as ConnectionPool);
+  const schema = assertSafeIdentifier(auth.schema!, "schema");
+  await pool.request().query(`SELECT username FROM ${schema}.[user] WHERE 1=0`);
+};
+
+export const insertAuthUser = async (
+  auth: Auth,
+  input: InsertAuthUserInput,
+  injectedPool?: ConnectionPool,
+): Promise<void> => {
+  const pool = injectedPool ?? (databasesConnections[auth.databaseEntity.name] as ConnectionPool);
+
+  const schema = assertSafeIdentifier(auth.schema!, "schema");
+  const hashed = await hashPassword(input.password);
+
+  await pool
+    .request()
+    .input("username", NVarChar(50), input.username)
+    .input("password", NVarChar(255), hashed)
+    .input("role", NVarChar(20), input.role)
+    .input("is_active", Bit, true)
+    .input("claims", NVarChar(MAX), JSON.stringify(input.claims ?? {}))
+    .query(
+      `INSERT INTO ${schema}.[user] (username, password, role, is_active, claims)
+         VALUES (@username, @password, @role, @is_active, @claims)`,
+    );
+};