@graphoria/server 0.2.0 → 0.2.2

package/src/types/zod/db.ts

@@ -1,13 +1,8 @@
 import { z } from "zod";
 
-import {
-  BunSQLConnectionOptionsZod,
-  DatabaseConnectionZod,
-  DatabaseSchemaConfigZod,
-  MSSQLConnectionOptionsZod,
-  TableRelationshipZod as TableRelationshipBaseZod,
-} from "../../config";
+import { TableRelationshipZod as TableRelationshipBaseZod } from "../../config";
 import { genResolverName } from "../../databases/transformers/genResolverName";
+import { sanitizeGraphQLName } from "../../databases/transformers/graphqlName";
 
 // Re-export base types and schemas from the config module
 export type {
@@ -43,6 +38,9 @@ export const TableColumnZod = z
   })
   .transform((val) => ({
     name: val.name,
+    // The SQL identifier stays in `name`; `fieldName` is what GraphQL exposes it as.
+    // Nothing emitting SQL may read `fieldName`, nothing emitting SDL may read `name`.
+    fieldName: sanitizeGraphQLName(val.name),
     dataType: val.dataType,
     isNullable: typeof val.isNullable === "boolean" ? val.isNullable : val.isNullable === 1,
     description: val.description ?? null,

package/src/types/zod/queue.ts

@@ -1,15 +1,7 @@
 import { z } from "zod";
 
-import {
-  BaseQueueConfigZod,
-  KafkaConnectionZod,
-  PublisherConfigZod,
-  RabbitMQConnectionZod,
-  ReconnectConfigZod,
-  SubscriberConfigZod,
-  TopicConfigZod,
-} from "../../config";
-import type { CacheContext, SubscriberHandler } from "../../config";
+import { BaseQueueConfigZod, KafkaConnectionZod, RabbitMQConnectionZod } from "../../config";
+import type { SubscriberHandler } from "../../config";
 
 // Re-export base types and schemas from the config module
 export type {

package/src/utils/sessionVariables.ts

@@ -37,6 +37,10 @@ const resolveDotPath = (obj: Record<string, unknown>, path: string): unknown =>
  *
  * @param filter - Filter object with potential session variables
  * @param session - JWT payload containing user session data
+ * @param onResolved - Called with each substituted claim value; its return value
+ *   is what lands in the filter. The caller uses this to parameterize the value
+ *   rather than letting it be inlined into SQL — a claim is attacker-influenced
+ *   whenever users can change their own profile data.
  * @returns Filter object with session variables replaced
  *
  * @example
@@ -54,6 +58,7 @@ const resolveDotPath = (obj: Record<string, unknown>, path: string): unknown =>
 export const replaceSessionVariables = (
   filter: Record<string, unknown>,
   session: SessionContext | null,
+  onResolved?: (value: unknown) => unknown,
 ): Record<string, unknown> => {
   if (!filter || !session) {
     return filter;
@@ -79,7 +84,7 @@ export const replaceSessionVariables = (
             );
           }
 
-          processedOperators[operator] = sessionValue;
+          processedOperators[operator] = onResolved ? onResolved(sessionValue) : sessionValue;
         }
         // Recursively handle nested objects
         else if (
@@ -90,6 +95,7 @@ export const replaceSessionVariables = (
           processedOperators[operator] = replaceSessionVariables(
             operatorValue as Record<string, unknown>,
             session,
+            onResolved,
           );
         }
         // Keep other values as-is