@graphoria/server 0.1.5 → 0.2.1

package/src/databases/engines/mssql/query/index.ts

@@ -16,26 +16,32 @@ import {
   isAggregationField,
   isSingleQuery,
   processFieldSelectionsMSSQL,
+  sqlColumnName,
   wrapIdentifierMSSQL,
 } from "../../../common";
 
+import { applyDirectives } from "../../../directives";
+
 // FOR JSON PATH uses the unbracketed alias as the JSON key, so bracket-quoting
 // (required for reserved words like PRINT) never leaks into results.
 
 // Generate CTE for aggregations
 const buildAggregationCTE = (
+  entities: MergedEntities,
+  tableName: string,
   groupByInfo: GroupByInfo,
   dottedQuotedName: string,
   tableAlias: string,
   whereClause: string,
 ): string => {
   const { groupByFields, aggregations, cteAlias } = groupByInfo;
+  const sqlName = (fieldName: string) => sqlColumnName(entities, tableName, fieldName);
 
   const selectClauses: string[] = [];
 
   // Add group by fields
   groupByFields.forEach((field) => {
-    selectClauses.push(`${tableAlias}.${wrapIdentifierMSSQL(field)}`);
+    selectClauses.push(`${tableAlias}.${wrapIdentifierMSSQL(sqlName(field))}`);
   });
 
   // Add aggregations
@@ -44,13 +50,17 @@ const buildAggregationCTE = (
       selectClauses.push(`COUNT(*) AS ${agg.alias}`);
     } else {
       const func = agg.name.toUpperCase();
-      selectClauses.push(
-        `${func}(${tableAlias}.${wrapIdentifierMSSQL(agg.fieldName)}) AS ${agg.alias}`,
-      );
+      // SQL Server's AVG over an integer column is integer division — AVG of
+      // 1, 5, 5, 2 is 3, not 3.25 — so the average has to be taken on a float.
+      const operand =
+        agg.name === "avg"
+          ? `CAST(${tableAlias}.${wrapIdentifierMSSQL(sqlName(agg.fieldName))} AS FLOAT)`
+          : `${tableAlias}.${wrapIdentifierMSSQL(sqlName(agg.fieldName))}`;
+      selectClauses.push(`${func}(${operand}) AS ${agg.alias}`);
     }
   });
 
-  const groupByClause = `GROUP BY ${groupByFields.map((field) => `${tableAlias}.${wrapIdentifierMSSQL(field)}`).join(", ")}`;
+  const groupByClause = `GROUP BY ${groupByFields.map((field) => `${tableAlias}.${wrapIdentifierMSSQL(sqlName(field))}`).join(", ")}`;
 
   return `${cteAlias} AS (
     SELECT
@@ -64,6 +74,7 @@ const buildAggregationCTE = (
 // Build the main query for grouped results
 const buildGroupedQuery = (
   entities: MergedEntities,
+  variablesDefinition: VariableDefinition[],
   field: SelectionAnalysis,
   groupByInfo: GroupByInfo,
   dottedQuotedName: string,
@@ -73,15 +84,22 @@ const buildGroupedQuery = (
   const { groupByFields, aggregations, hasItems, keyResolved, hasKey, keys, cteAlias } =
     groupByInfo;
 
+  const sqlName = (fieldName: string) => sqlColumnName(entities, field.name, fieldName);
+
   const selectClauses: string[] = [];
 
   if (hasKey) {
     // Add key object with group by fields
     const keyFields = keys
-      .map(
-        (field) =>
-          `${cteAlias}.${wrapIdentifierMSSQL(field.name)} AS ${wrapIdentifierMSSQL(field.alias || field.name)}`,
-      )
+      .map((key) => {
+        const selector = applyDirectives(
+          `${cteAlias}.${wrapIdentifierMSSQL(sqlName(key.name))}`,
+          key.directives,
+          "mssql",
+          variablesDefinition,
+        );
+        return `${selector} AS ${wrapIdentifierMSSQL(key.alias || key.name)}`;
+      })
       .join(", ");
 
     selectClauses.push(
@@ -107,16 +125,21 @@ const buildGroupedQuery = (
     if (itemsSelection?.selections) {
       const itemFields = itemsSelection.selections
         .filter((sel) => !isAggregationField(sel.name) && sel.name !== "items")
-        .map(
-          (sel) =>
-            `${tableAlias}.${wrapIdentifierMSSQL(sel.name)} AS ${wrapIdentifierMSSQL(sel.alias || sel.name)}`,
-        )
+        .map((sel) => {
+          const selector = applyDirectives(
+            `${tableAlias}.${wrapIdentifierMSSQL(sqlName(sel.name))}`,
+            sel.directives,
+            "mssql",
+            variablesDefinition,
+          );
+          return `${selector} AS ${wrapIdentifierMSSQL(sel.alias || sel.name)}`;
+        })
         .join(", ");
 
       if (itemFields) {
         const joinConditions = groupByFields.map(
-          (field) =>
-            `${tableAlias}.${wrapIdentifierMSSQL(field)} = ${cteAlias}.${wrapIdentifierMSSQL(field)}`,
+          (groupByField) =>
+            `${tableAlias}.${wrapIdentifierMSSQL(sqlName(groupByField))} = ${cteAlias}.${wrapIdentifierMSSQL(sqlName(groupByField))}`,
         );
 
         selectClauses.push(`JSON_QUERY(ISNULL((
@@ -195,7 +218,14 @@ export const generateSQL = (
         {},
       );
 
-      const cte = buildAggregationCTE(groupByInfo, dottedQuotedName, tableAlias, whereClause);
+      const cte = buildAggregationCTE(
+        entities,
+        field.name,
+        groupByInfo,
+        dottedQuotedName,
+        tableAlias,
+        whereClause,
+      );
       ctes.push(cte);
     }
 
@@ -265,6 +295,7 @@ export const buildSQLForField = (
     // Handle GROUP BY aggregation query
     const mainQuery = buildGroupedQuery(
       entities,
+      variablesDefinition,
       field,
       groupByInfo,
       dottedQuotedName,

package/src/databases/engines/mysql/auth.ts

@@ -41,7 +41,7 @@ export const checkUserCredentials = async (
   const schema = assertSafeIdentifier(auth.schema!, "schema");
 
   const result = await pool.unsafe<UserRecord[]>(
-    `SELECT * FROM \`${schema}\`.\`user\` WHERE username = $1 AND is_active = TRUE`,
+    `SELECT * FROM \`${schema}\`.\`user\` WHERE username = ? AND is_active = TRUE`,
     [username],
   );
 
@@ -94,7 +94,7 @@ export const insertAuthUser = async (
 
   await pool.unsafe(
     `INSERT INTO \`${schema}\`.\`user\` (username, password, role, is_active, claims)
-       VALUES ($1, $2, $3, TRUE, $4)`,
+       VALUES (?, ?, ?, TRUE, ?)`,
     [input.username, hashed, input.role, JSON.stringify(input.claims ?? {})],
   );
 };

package/src/databases/engines/mysql/connection.ts

@@ -6,6 +6,7 @@ import type { Database } from "../../../types/configuration";
 import type { ProcedureResolver } from "../../../types/db";
 
 import { databasesConnections } from "../../../singletons/databases";
+import { toMySQLPlaceholders } from "./placeholders";
 
 export const getPool = async (db: Database) => {
   const opts = db.connectionOptions as BunSQLConnectionOptions | undefined;
@@ -42,10 +43,10 @@ export const executeQueryFactory =
   ) => {
     const pool = singleQuery ? await getPool(db) : await getPoolSingleton(db);
 
-    const result = await pool.unsafe<T>(
-      query,
-      variablesDefinition.map((v) => values[v.name]),
-    );
+    // Bun's MySQL adapter binds `?` positionally; the builders emit `$n`.
+    const bound = toMySQLPlaceholders(query, variablesDefinition, values);
+
+    const result = await pool.unsafe<T>(bound.query, bound.params);
 
     if (singleQuery) {
       await pool.close();

package/src/databases/engines/mysql/getStructure.ts

@@ -3,8 +3,23 @@ import type { Database } from "../../../types/configuration";
 import { DatabaseStructureZod } from "../../../types/zod/db";
 import { executeQueryJSONSingle } from "./connection";
 
+/**
+ * Ordering carried out of SQL and restored here: JSON_ARRAYAGG accepts no
+ * ORDER BY. GROUP_CONCAT does, but silently truncates at group_concat_max_len
+ * (1024 bytes by default), which any table past ~10 columns exceeds — the JSON
+ * is then cut mid-object and CAST(... AS JSON) fails.
+ */
+type Ordered = { ordinalPosition?: number };
+type RawForeignKey = { fkName?: string; columns: Ordered[] };
+type RawStructure = {
+  tables?: { columns?: Ordered[]; foreignKeys?: RawForeignKey[] }[];
+  storedProcedures?: { parameters?: Ordered[] }[];
+};
+
+const byOrdinal = (a: Ordered, b: Ordered) => (a.ordinalPosition ?? 0) - (b.ordinalPosition ?? 0);
+
 export const getDatabaseStructure = async (db: Database) => {
-  const res = await executeQueryJSONSingle(
+  const res = await executeQueryJSONSingle<RawStructure>(
     `
     SELECT JSON_OBJECT(
       'tables', JSON_ARRAYAGG(
@@ -31,7 +46,7 @@ export const getDatabaseStructure = async (db: Database) => {
             )
           )
           FROM information_schema.routines r
-          
+
           -- Parameters
           LEFT JOIN LATERAL (
             SELECT JSON_ARRAYAGG(
@@ -40,16 +55,16 @@ export const getDatabaseStructure = async (db: Database) => {
                 'dataType', p.data_type,
                 'maxLength', COALESCE(p.character_maximum_length, 0),
                 'precision', COALESCE(p.numeric_precision, 0),
-                'scale', COALESCE(p.numeric_scale, 0)
+                'scale', COALESCE(p.numeric_scale, 0),
+                'ordinalPosition', p.ordinal_position
               )
             ) AS param_array
             FROM information_schema.parameters p
             WHERE p.specific_name = r.specific_name
               AND p.specific_schema = r.routine_schema
               AND p.parameter_name IS NOT NULL
-            ORDER BY p.ordinal_position
           ) params ON true
-          
+
           WHERE r.routine_type IN ('FUNCTION', 'PROCEDURE')
           AND r.routine_schema NOT IN ('mysql', 'information_schema', 'performance_schema', 'sys')
         ),
@@ -58,22 +73,20 @@ export const getDatabaseStructure = async (db: Database) => {
     ) as json_result
     FROM (
       SELECT table_schema, table_name, table_type
-      FROM information_schema.tables 
+      FROM information_schema.tables
       WHERE table_type IN ('BASE TABLE', 'VIEW')
         AND table_schema NOT IN ('mysql', 'information_schema', 'performance_schema', 'sys')
     ) t
     LEFT JOIN LATERAL (
-      -- build an ordered JSON array of columns using GROUP_CONCAT
-      SELECT IFNULL(
-        CAST(CONCAT('[', GROUP_CONCAT(
-          JSON_OBJECT(
-            'name', isc.column_name,
-            'dataType', isc.data_type,
-            'isNullable', CASE WHEN isc.is_nullable = 'YES' THEN true ELSE false END,
-            'collation', isc.collation_name,
-            'description', NULL
-          ) ORDER BY isc.ordinal_position SEPARATOR ','), ']') AS JSON),
-        JSON_ARRAY()
+      SELECT JSON_ARRAYAGG(
+        JSON_OBJECT(
+          'name', isc.column_name,
+          'dataType', isc.data_type,
+          'isNullable', CASE WHEN isc.is_nullable = 'YES' THEN true ELSE false END,
+          'collation', isc.collation_name,
+          'description', NULL,
+          'ordinalPosition', isc.ordinal_position
+        )
       ) AS columns
       FROM information_schema.columns isc
       WHERE isc.table_schema = t.table_schema
@@ -81,26 +94,28 @@ export const getDatabaseStructure = async (db: Database) => {
     ) col ON TRUE
     LEFT JOIN LATERAL (
       -- aggregate FKs: first aggregate columns per constraint, then aggregate constraints
-      SELECT IFNULL(
-        CAST(CONCAT('[', GROUP_CONCAT(
-          JSON_OBJECT(
-            'schema', fk_sub.referenced_table_schema,
-            'name', fk_sub.referenced_table_name,
-            'columns', fk_sub.columns_arr
-          ) ORDER BY fk_sub.fk_name SEPARATOR ','), ']') AS JSON),
-        JSON_ARRAY()
+      SELECT JSON_ARRAYAGG(
+        JSON_OBJECT(
+          'schema', fk_sub.referenced_table_schema,
+          'name', fk_sub.referenced_table_name,
+          'columns', fk_sub.columns_arr,
+          'fkName', fk_sub.fk_name
+        )
       ) AS fk_agg
       FROM (
-        SELECT 
+        SELECT
           kcu.constraint_name AS fk_name,
           kcu.table_schema,
           kcu.table_name,
           kcu.referenced_table_schema,
           kcu.referenced_table_name,
-          CAST(CONCAT('[', GROUP_CONCAT(
-            JSON_OBJECT('source', kcu.column_name, 'target', kcu.referenced_column_name)
-            ORDER BY kcu.ordinal_position SEPARATOR ','
-          ), ']') AS JSON) AS columns_arr
+          JSON_ARRAYAGG(
+            JSON_OBJECT(
+              'source', kcu.column_name,
+              'target', kcu.referenced_column_name,
+              'ordinalPosition', kcu.ordinal_position
+            )
+          ) AS columns_arr
         FROM information_schema.key_column_usage kcu
         WHERE kcu.referenced_table_schema IS NOT NULL
           AND kcu.table_schema = t.table_schema
@@ -113,5 +128,21 @@ export const getDatabaseStructure = async (db: Database) => {
     db,
   );
 
+  for (const table of res.tables ?? []) {
+    table.columns?.sort(byOrdinal);
+    table.foreignKeys?.sort((a, b) => (a.fkName ?? "").localeCompare(b.fkName ?? ""));
+
+    // TableRelationshipZod is strict, so the ordering keys must go before parsing.
+    for (const foreignKey of table.foreignKeys ?? []) {
+      foreignKey.columns.sort(byOrdinal);
+      for (const column of foreignKey.columns) delete column.ordinalPosition;
+      delete foreignKey.fkName;
+    }
+  }
+
+  for (const storedProcedure of res.storedProcedures ?? []) {
+    storedProcedure.parameters?.sort(byOrdinal);
+  }
+
   return DatabaseStructureZod.parse(res);
 };

package/src/databases/engines/mysql/placeholders.ts

@@ -0,0 +1,84 @@
+import type { VariableDefinition } from "../../../analyzeQuery/types";
+
+/**
+ * Rewrites the builder's PostgreSQL-style `$n` placeholders to MySQL's `?`.
+ *
+ * The query builders are shared across engines and number placeholders by index
+ * into `variablesDefinition`. Bun's MySQL adapter binds `?` by position of
+ * occurrence in the statement text, and the two orders do not match: the WHERE
+ * string is interpolated into more than one sub-statement on the aggregate path,
+ * nested subqueries are built before the outer WHERE is appended, and a single
+ * directive can emit `$2` before `$1` and `$1` twice. Rewriting here — the one
+ * point where the finished statement and its values meet — makes text order the
+ * binding order by construction.
+ *
+ * The scan skips quoted runs because generated SQL does carry `$n` inside string
+ * literals: a config-supplied relationship condition value is interpolated as a
+ * literal, and introspected identifiers may contain `$`.
+ */
+export const toMySQLPlaceholders = (
+  query: string,
+  variablesDefinition: VariableDefinition[] = [],
+  values: Record<string, unknown> = {},
+): { query: string; params: unknown[] } => {
+  const params: unknown[] = [];
+  let rewritten = "";
+  let index = 0;
+
+  while (index < query.length) {
+    const char = query[index]!;
+
+    if (char === "'" || char === '"' || char === "`") {
+      const start = index;
+      index++;
+
+      while (index < query.length) {
+        // Backslash escapes apply inside string literals but never inside a
+        // backtick-quoted identifier, where the only escape is a doubled tick.
+        if (char !== "`" && query[index] === "\\") {
+          index += 2;
+          continue;
+        }
+        if (query[index] === char) {
+          if (query[index + 1] === char) {
+            index += 2;
+            continue;
+          }
+          index++;
+          break;
+        }
+        index++;
+      }
+
+      rewritten += query.slice(start, index);
+      continue;
+    }
+
+    if (char === "$") {
+      const match = /^\$(\d+)/.exec(query.slice(index));
+
+      if (match) {
+        const position = Number(match[1]);
+        const definition = variablesDefinition[position - 1];
+
+        if (!definition) {
+          throw new Error(
+            `MySQL query references $${position} but only ${variablesDefinition.length} variable${
+              variablesDefinition.length === 1 ? " is" : "s are"
+            } defined`,
+          );
+        }
+
+        params.push(values[definition.name]);
+        rewritten += "?";
+        index += match[0].length;
+        continue;
+      }
+    }
+
+    rewritten += char;
+    index++;
+  }
+
+  return { query: rewritten, params };
+};

package/src/databases/engines/mysql/query/index.ts

@@ -16,23 +16,29 @@ import {
   isAggregationField,
   isSingleQuery,
   processFieldSelectionsMySQL,
+  sqlColumnName,
   wrapIdentifierMySQL,
 } from "../../../common";
 
+import { applyDirectives } from "../../../directives";
+
 // Generate CTE for aggregations
 const buildAggregationCTE = (
+  entities: MergedEntities,
+  tableName: string,
   groupByInfo: GroupByInfo,
   dottedQuotedName: string,
   tableAlias: string,
   whereClause: string,
 ): string => {
   const { groupByFields, aggregations, cteAlias } = groupByInfo;
+  const sqlName = (fieldName: string) => sqlColumnName(entities, tableName, fieldName);
 
   const selectClauses: string[] = [];
 
   // Add group by fields
   groupByFields.forEach((field) => {
-    selectClauses.push(`${tableAlias}.${wrapIdentifierMySQL(field)}`);
+    selectClauses.push(`${tableAlias}.${wrapIdentifierMySQL(sqlName(field))}`);
   });
 
   // Add aggregations
@@ -42,12 +48,12 @@ const buildAggregationCTE = (
     } else {
       const func = agg.name.toUpperCase();
       selectClauses.push(
-        `${func}(${tableAlias}.${wrapIdentifierMySQL(agg.fieldName)}) AS ${agg.alias}`,
+        `${func}(${tableAlias}.${wrapIdentifierMySQL(sqlName(agg.fieldName))}) AS ${agg.alias}`,
       );
     }
   });
 
-  const groupByClause = `GROUP BY ${groupByFields.map((field) => `${tableAlias}.${wrapIdentifierMySQL(field)}`).join(", ")}`;
+  const groupByClause = `GROUP BY ${groupByFields.map((field) => `${tableAlias}.${wrapIdentifierMySQL(sqlName(field))}`).join(", ")}`;
 
   return `${cteAlias} AS (
     SELECT
@@ -61,6 +67,7 @@ const buildAggregationCTE = (
 // Build the main query for grouped results
 const buildGroupedQuery = (
   entities: MergedEntities,
+  variablesDefinition: VariableDefinition[],
   field: SelectionAnalysis,
   groupByInfo: GroupByInfo,
   dottedQuotedName: string,
@@ -70,12 +77,22 @@ const buildGroupedQuery = (
   const { groupByFields, aggregations, hasItems, keyResolved, hasKey, keys, cteAlias } =
     groupByInfo;
 
+  const sqlName = (fieldName: string) => sqlColumnName(entities, field.name, fieldName);
+
   const selectClauses: string[] = [];
 
   if (hasKey) {
     // Add key object with group by fields
     const keyFields = keys
-      .map((key) => `'${key.alias || key.name}', ${cteAlias}.${wrapIdentifierMySQL(key.name)}`)
+      .map((key) => {
+        const selector = applyDirectives(
+          `${cteAlias}.${wrapIdentifierMySQL(sqlName(key.name))}`,
+          key.directives,
+          "mysql",
+          variablesDefinition,
+        );
+        return `'${key.alias || key.name}', ${selector}`;
+      })
       .join(", ");
 
     selectClauses.push(`'${keyResolved}', JSON_OBJECT(${keyFields})`);
@@ -99,13 +116,21 @@ const buildGroupedQuery = (
     if (itemsSelection?.selections) {
       const itemFields = itemsSelection.selections
         .filter((sel) => !isAggregationField(sel.name) && sel.name !== "items")
-        .map((sel) => `'${sel.alias || sel.name}', ${tableAlias}.${wrapIdentifierMySQL(sel.name)}`)
+        .map((sel) => {
+          const selector = applyDirectives(
+            `${tableAlias}.${wrapIdentifierMySQL(sqlName(sel.name))}`,
+            sel.directives,
+            "mysql",
+            variablesDefinition,
+          );
+          return `'${sel.alias || sel.name}', ${selector}`;
+        })
         .join(", ");
 
       if (itemFields) {
         const joinConditions = groupByFields.map(
-          (field) =>
-            `${tableAlias}.${wrapIdentifierMySQL(field)} = ${cteAlias}.${wrapIdentifierMySQL(field)}`,
+          (groupByField) =>
+            `${tableAlias}.${wrapIdentifierMySQL(sqlName(groupByField))} = ${cteAlias}.${wrapIdentifierMySQL(sqlName(groupByField))}`,
         );
 
         const whereConditions = whereClause
@@ -175,7 +200,14 @@ export const generateSQL = (
         {},
       );
 
-      const cte = buildAggregationCTE(groupByInfo, dottedQuotedName, tableAlias, whereClause);
+      const cte = buildAggregationCTE(
+        entities,
+        field.name,
+        groupByInfo,
+        dottedQuotedName,
+        tableAlias,
+        whereClause,
+      );
       ctes.push(cte);
     }
 
@@ -244,6 +276,7 @@ export const buildSQLForField = (
     // Handle GROUP BY aggregation query
     const mainQuery = buildGroupedQuery(
       entities,
+      variablesDefinition,
       field,
       groupByInfo,
       dottedQuotedName,
@@ -277,16 +310,41 @@ export const buildSQLForField = (
     ([name, selector]) => `'${name}', ${selector}`,
   );
 
-  const fromClause = `FROM ${dottedQuotedName} ${tableAlias}${withoutArrayWrapper ? " LIMIT 1" : ""}`;
+  const fromClause = `FROM ${dottedQuotedName} ${tableAlias}`;
 
   const orderByClause = buildOrderByClauseMySQL(entities, field, tableAlias);
   const paginationClause = buildPaginationClauseMySQL(field, variablesDefinition);
 
   const isArraySelection = !!field.isArray && !withoutArrayWrapper;
 
+  // JSON_ARRAYAGG accepts no ORDER BY of its own and collapses the rows before
+  // LIMIT can trim them, so both ordering and pagination have to happen in a
+  // derived table that the aggregate then reads.
+  if (isArraySelection && (orderByClause || paginationClause)) {
+    const pageAlias = `${tableAlias}_page`;
+    // A nested selection is correlated to its parent through the where clause,
+    // and a plain derived table may not carry an outer reference. LATERAL lifts
+    // that restriction — MySQL 8.0.14 and newer. Unordered, unpaginated nested
+    // selections never take this branch, so older servers keep working for them.
+    const lateral = parentTableName ? "LATERAL " : "";
+
+    // NO_MERGE is load-bearing, not a hint about performance: without it MySQL
+    // merges the derived table into the outer query and discards its ORDER BY,
+    // so the array comes back in storage order. A LIMIT blocks the merge on its
+    // own, which is why only the unpaginated ordering was affected.
+    return `
+    COALESCE((
+      SELECT /*+ NO_MERGE(${pageAlias}) */ JSON_ARRAYAGG(${pageAlias}.obj)
+      FROM ${lateral}(
+        SELECT JSON_OBJECT(${selectList}) AS obj ${fromClause} ${whereClause} ${orderByClause} ${paginationClause}
+      ) ${pageAlias}
+    ), JSON_ARRAY())
+  `;
+  }
+
   return `
     COALESCE((
-      SELECT ${isArraySelection ? `JSON_ARRAYAGG(JSON_OBJECT(${selectList}))` : `JSON_OBJECT(${selectList})`} ${fromClause} ${orderByClause} ${whereClause} ${paginationClause ? ` ${paginationClause}` : ""}
+      SELECT ${isArraySelection ? `JSON_ARRAYAGG(JSON_OBJECT(${selectList}))` : `JSON_OBJECT(${selectList})`} ${fromClause} ${whereClause} ${orderByClause}${withoutArrayWrapper ? " LIMIT 1" : ""}
     ), ${isArraySelection ? "JSON_ARRAY()" : "null"})
   `;
 };