@hesed/mysql 0.6.1 → 0.6.2

package/README.md

@@ -26,7 +26,7 @@ $ npm install -g @hesed/mysql
 $ mq COMMAND
 running command...
 $ mq (--version)
-@hesed/mysql/0.6.1 linux-x64 node-v24.18.0
+@hesed/mysql/0.6.2 linux-x64 node-v24.20.0
 $ mq --help [COMMAND]
 USAGE
   $ mq COMMAND
@@ -82,7 +82,7 @@ EXAMPLES
   $ mq mysql auth add -p prod
 ```
 
-_See code: [src/commands/mysql/auth/add.ts](https://github.com/hesedcasa/mysql/blob/v0.6.1/src/commands/mysql/auth/add.ts)_
+_See code: [src/commands/mysql/auth/add.ts](https://github.com/hesedcasa/mysql/blob/v0.6.2/src/commands/mysql/auth/add.ts)_
 
 ## `mq mysql auth delete`
 
@@ -107,7 +107,7 @@ EXAMPLES
   $ mq mysql auth delete -p prod
 ```
 
-_See code: [src/commands/mysql/auth/delete.ts](https://github.com/hesedcasa/mysql/blob/v0.6.1/src/commands/mysql/auth/delete.ts)_
+_See code: [src/commands/mysql/auth/delete.ts](https://github.com/hesedcasa/mysql/blob/v0.6.2/src/commands/mysql/auth/delete.ts)_
 
 ## `mq mysql auth list`
 
@@ -127,7 +127,7 @@ EXAMPLES
   $ mq mysql auth list
 ```
 
-_See code: [src/commands/mysql/auth/list.ts](https://github.com/hesedcasa/mysql/blob/v0.6.1/src/commands/mysql/auth/list.ts)_
+_See code: [src/commands/mysql/auth/list.ts](https://github.com/hesedcasa/mysql/blob/v0.6.2/src/commands/mysql/auth/list.ts)_
 
 ## `mq mysql auth profile`
 
@@ -152,7 +152,7 @@ EXAMPLES
   $ mq mysql auth profile --default test
 ```
 
-_See code: [src/commands/mysql/auth/profile.ts](https://github.com/hesedcasa/mysql/blob/v0.6.1/src/commands/mysql/auth/profile.ts)_
+_See code: [src/commands/mysql/auth/profile.ts](https://github.com/hesedcasa/mysql/blob/v0.6.2/src/commands/mysql/auth/profile.ts)_
 
 ## `mq mysql auth test`
 
@@ -177,7 +177,7 @@ EXAMPLES
   $ mq mysql auth test -p prod
 ```
 
-_See code: [src/commands/mysql/auth/test.ts](https://github.com/hesedcasa/mysql/blob/v0.6.1/src/commands/mysql/auth/test.ts)_
+_See code: [src/commands/mysql/auth/test.ts](https://github.com/hesedcasa/mysql/blob/v0.6.2/src/commands/mysql/auth/test.ts)_
 
 ## `mq mysql auth update`
 
@@ -211,7 +211,7 @@ EXAMPLES
   $ mq mysql auth update -p test
 ```
 
-_See code: [src/commands/mysql/auth/update.ts](https://github.com/hesedcasa/mysql/blob/v0.6.1/src/commands/mysql/auth/update.ts)_
+_See code: [src/commands/mysql/auth/update.ts](https://github.com/hesedcasa/mysql/blob/v0.6.2/src/commands/mysql/auth/update.ts)_
 
 ## `mq mysql databases`
 
@@ -236,7 +236,7 @@ EXAMPLES
   $ mq mysql databases -p staging
 ```
 
-_See code: [src/commands/mysql/databases.ts](https://github.com/hesedcasa/mysql/blob/v0.6.1/src/commands/mysql/databases.ts)_
+_See code: [src/commands/mysql/databases.ts](https://github.com/hesedcasa/mysql/blob/v0.6.2/src/commands/mysql/databases.ts)_
 
 ## `mq mysql describe-table TABLE`
 
@@ -265,7 +265,7 @@ EXAMPLES
   $ mq mysql describe-table orders --toon -p prod
 ```
 
-_See code: [src/commands/mysql/describe-table.ts](https://github.com/hesedcasa/mysql/blob/v0.6.1/src/commands/mysql/describe-table.ts)_
+_See code: [src/commands/mysql/describe-table.ts](https://github.com/hesedcasa/mysql/blob/v0.6.2/src/commands/mysql/describe-table.ts)_
 
 ## `mq mysql explain QUERY`
 
@@ -294,7 +294,7 @@ EXAMPLES
   $ mq mysql explain "SELECT * FROM orders JOIN users ON orders.user_id = users.id" --json
 ```
 
-_See code: [src/commands/mysql/explain.ts](https://github.com/hesedcasa/mysql/blob/v0.6.1/src/commands/mysql/explain.ts)_
+_See code: [src/commands/mysql/explain.ts](https://github.com/hesedcasa/mysql/blob/v0.6.2/src/commands/mysql/explain.ts)_
 
 ## `mq mysql indexes TABLE`
 
@@ -323,7 +323,7 @@ EXAMPLES
   $ mq mysql indexes orders --json -p prod
 ```
 
-_See code: [src/commands/mysql/indexes.ts](https://github.com/hesedcasa/mysql/blob/v0.6.1/src/commands/mysql/indexes.ts)_
+_See code: [src/commands/mysql/indexes.ts](https://github.com/hesedcasa/mysql/blob/v0.6.2/src/commands/mysql/indexes.ts)_
 
 ## `mq mysql query QUERY`
 
@@ -355,7 +355,7 @@ EXAMPLES
   $ mq mysql query "DELETE FROM sessions" -p prod --skip-confirmation
 ```
 
-_See code: [src/commands/mysql/query.ts](https://github.com/hesedcasa/mysql/blob/v0.6.1/src/commands/mysql/query.ts)_
+_See code: [src/commands/mysql/query.ts](https://github.com/hesedcasa/mysql/blob/v0.6.2/src/commands/mysql/query.ts)_
 
 ## `mq mysql tables`
 
@@ -380,5 +380,5 @@ EXAMPLES
   $ mq mysql tables -p local
 ```
 
-_See code: [src/commands/mysql/tables.ts](https://github.com/hesedcasa/mysql/blob/v0.6.1/src/commands/mysql/tables.ts)_
+_See code: [src/commands/mysql/tables.ts](https://github.com/hesedcasa/mysql/blob/v0.6.2/src/commands/mysql/tables.ts)_
 <!-- commandsstop -->

package/dist/mysql/mysql-utils.js

@@ -45,7 +45,7 @@ export class MySQLUtil {
         catch (error) {
             const errorMessage = error instanceof Error ? error.message : String(error);
             return {
-                error: `ERROR: ${errorMessage}`,
+                error: errorMessage,
                 success: false,
             };
         }
@@ -110,7 +110,7 @@ export class MySQLUtil {
         catch (error) {
             const errorMessage = error instanceof Error ? error.message : String(error);
             return {
-                error: `ERROR: ${errorMessage}`,
+                error: errorMessage,
                 success: false,
             };
         }
@@ -129,7 +129,7 @@ export class MySQLUtil {
         catch (error) {
             const errorMessage = error instanceof Error ? error.message : String(error);
             return {
-                error: `ERROR: ${errorMessage}`,
+                error: errorMessage,
                 success: false,
             };
         }
@@ -149,7 +149,7 @@ export class MySQLUtil {
         catch (error) {
             const errorMessage = error instanceof Error ? error.message : String(error);
             return {
-                error: `ERROR: ${errorMessage}`,
+                error: errorMessage,
                 success: false,
             };
         }
@@ -158,6 +158,14 @@ export class MySQLUtil {
         try {
             const [rows] = await this.runQuery(profileName, 'SHOW TABLES');
             const rowsArray = rows;
+            // SHOW TABLES names its one column after the database, so the key has to
+            // be read off a row — an empty schema has none.
+            if (rowsArray.length === 0) {
+                return {
+                    data: { result: 'No tables found in this database', tables: [] },
+                    success: true,
+                };
+            }
             const tableKey = Object.keys(rowsArray[0])[0];
             const tables = rowsArray.map((row) => row[tableKey]);
             return {
@@ -171,7 +179,7 @@ export class MySQLUtil {
         catch (error) {
             const errorMessage = error instanceof Error ? error.message : String(error);
             return {
-                error: `ERROR: ${errorMessage}`,
+                error: errorMessage,
                 success: false,
             };
         }
@@ -190,7 +198,7 @@ export class MySQLUtil {
         catch (error) {
             const errorMessage = error instanceof Error ? error.message : String(error);
             return {
-                error: `ERROR: ${errorMessage}`,
+                error: errorMessage,
                 success: false,
             };
         }
@@ -211,7 +219,7 @@ export class MySQLUtil {
         catch (error) {
             const errorMessage = error instanceof Error ? error.message : String(error);
             return {
-                error: `ERROR: ${errorMessage}`,
+                error: errorMessage,
                 success: false,
             };
         }

package/dist/mysql/query-validator.js

@@ -1,8 +1,149 @@
+// Escapes a config-supplied operation so it can be embedded in a pattern.
+function escapeForPattern(word) {
+    return word.replaceAll(/[$()*+.?[\\\]^{|}]/g, String.raw `\$&`);
+}
+// String literals ('...', "...") and quoted identifiers (`...`).
+const QUOTE_CHARS = new Set(['"', "'", '`']);
+// Returns the index just past the quoted run that starts at `start`, so the
+// caller can copy a string literal or quoted identifier through untouched. An
+// unterminated quote swallows the rest of the query, which keeps any keyword it
+// hides visible to the safety checks.
+function findQuoteEnd(query, start) {
+    const quote = query[start];
+    for (let index = start + 1; index < query.length; index += 1) {
+        // Backslash escapes apply inside string literals but not inside `identifiers`.
+        if (quote !== '`' && query[index] === '\\') {
+            index += 1;
+            continue;
+        }
+        if (query[index] === quote) {
+            // A doubled quote is an escaped quote, not the end of the run.
+            if (query[index + 1] === quote) {
+                index += 1;
+                continue;
+            }
+            return index + 1;
+        }
+    }
+    return query.length;
+}
+// Walks the query, yielding each stretch of it alongside the text MySQL would
+// actually execute there. Code and quoted runs come through untouched; an
+// ordinary comment collapses to a single space, so keyword matching sees
+// `DROP /* here */ DATABASE` for what MySQL sees: `DROP DATABASE`.
+//
+// The scan is quote aware — `--`, `#` and `/*` inside a string literal or a
+// quoted identifier are data, not the start of a comment.
+//
+// A `/*! ... */` version comment keeps its body, because MySQL executes it —
+// only the `/*!`, its leading version digits and the closing `*/` become
+// whitespace, so `DROP /*!40000 */ DATABASE` reads as `DROP DATABASE` here too.
+// MySQL 8.4 consumes a five- or six-digit version (`/*!080411 */` runs), and
+// any other digit run it executes as part of the body, where it can only turn
+// the statement into a syntax error — so every leading digit goes, whatever the
+// server's rule for them is.
+// A `/*+ ... */` hint comment goes entirely, like any other comment: its body
+// is hint syntax, never SQL MySQL would run.
+//
+// `quoted` marks a string literal or quoted identifier, so a caller that cares
+// about clause structure rather than raw text can blank it out.
+function* scanQuery(query) {
+    let index = 0;
+    while (index < query.length) {
+        const char = query[index];
+        if (QUOTE_CHARS.has(char)) {
+            const end = findQuoteEnd(query, index);
+            yield { executable: query.slice(index, end), quoted: true, start: index };
+            index = end;
+            continue;
+        }
+        if (char === '/' && query[index + 1] === '*') {
+            const close = query.indexOf('*/', index + 2);
+            const end = close === -1 ? query.length : close + 2;
+            const body = query.slice(index + 3, close === -1 ? query.length : close);
+            const versionComment = query[index + 2] === '!';
+            yield { executable: versionComment ? ` ${body.replace(/^\d+/u, ' ')} ` : ' ', quoted: false, start: index };
+            index = end;
+            continue;
+        }
+        // `--` only opens a comment when whitespace (or the end of the query)
+        // follows it; `a--b` is two minus signs.
+        const dashComment = char === '-' && query[index + 1] === '-' && /^\s*$/u.test(query[index + 2] ?? '');
+        if (char === '#' || dashComment) {
+            const newline = query.indexOf('\n', index);
+            yield { executable: ' ', quoted: false, start: index };
+            index = newline === -1 ? query.length : newline;
+            continue;
+        }
+        yield { executable: char, quoted: false, start: index };
+        index += 1;
+    }
+}
+// Replaces every non-executable MySQL comment with a single space, and every
+// string literal or quoted identifier too when `blankQuoted` is set.
+function stripComments(query, blankQuoted = false) {
+    let stripped = '';
+    for (const { executable, quoted } of scanQuery(query)) {
+        stripped += blankQuoted && quoted ? ' ' : executable;
+    }
+    return stripped;
+}
+// Index of the `;` that terminates the query's single statement — the last one
+// with nothing but whitespace and comments after it — or -1 when the query is
+// not terminated. A `;` inside a string literal or a comment is not a
+// terminator, because MySQL does not execute it as one.
+function findTrailingTerminator(query) {
+    let terminator = -1;
+    for (const { executable, start } of scanQuery(query)) {
+        if (executable === ';') {
+            terminator = start;
+        }
+        else if (/\S/u.test(executable)) {
+            // Executable text after a `;` means that `;` separated statements rather
+            // than ending the query.
+            terminator = -1;
+        }
+    }
+    return terminator;
+}
+// Strips comments, then trims and upper-cases what is left, giving the checks
+// below a single view of the SQL MySQL would actually execute. Quoted text
+// stays, so a keyword hidden in a string literal is still visible.
+function normalize(query) {
+    return stripComments(query).trim().toUpperCase();
+}
+// The same view with every string literal and quoted identifier blanked out.
+// Clause detection asks a structural question — does this statement have a
+// WHERE, does it have a LIMIT — and `SELECT 'LIMIT 5' FROM metrics` has neither,
+// so keeping the quoted text there would drop the row cap off a query that is
+// in fact unbounded. The blacklist and confirmation checks ask the opposite
+// question and keep quoted text on purpose.
+function normalizeClauses(query) {
+    return stripComments(query, true).trim().toUpperCase();
+}
+// Tests whether an operation appears in an already-normalized query as whole
+// words, allowing any run of whitespace between the words of a multi-word
+// operation ("DROP  DATABASE", "DROP\nDATABASE"). Comments are gone by this
+// point, so a comment between those words no longer hides the operation.
+//
+// The scan deliberately covers the whole query rather than just the leading
+// keyword: a destructive keyword is worth flagging wherever it appears. Word
+// boundaries stop the reverse mistake, where `nowhere_stats` reads as a WHERE
+// clause or `limit_reached` as a LIMIT. A keyword inside a string literal still
+// matches, which errs toward asking for confirmation rather than skipping it —
+// and keeps `PREPARE s FROM 'DROP DATABASE x'` in reach of the blacklist.
+function containsOperation(normalizedQuery, operation) {
+    const pattern = operation
+        .trim()
+        .split(/\s+/)
+        .map((word) => escapeForPattern(word))
+        .join(String.raw `\s+`);
+    return new RegExp(String.raw `\b${pattern}\b`, 'u').test(normalizedQuery);
+}
 export function checkBlacklist(query, blacklistedOperations) {
-    const normalizedQuery = query.trim().toUpperCase();
+    const normalizedQuery = normalize(query);
     for (const operation of blacklistedOperations) {
-        const normalizedOp = operation.toUpperCase();
-        if (normalizedQuery.includes(normalizedOp)) {
+        if (containsOperation(normalizedQuery, operation.toUpperCase())) {
             return {
                 allowed: false,
                 reason: `Operation "${operation}" is blacklisted and not allowed`,
@@ -12,10 +153,9 @@ export function checkBlacklist(query, blacklistedOperations) {
     return { allowed: true };
 }
 export function requiresConfirmation(query, confirmationOperations) {
-    const normalizedQuery = query.trim().toUpperCase();
+    const normalizedQuery = normalize(query);
     for (const operation of confirmationOperations) {
-        const normalizedOp = operation.toUpperCase();
-        if (normalizedQuery.startsWith(normalizedOp) || normalizedQuery.includes(` ${normalizedOp} `)) {
+        if (containsOperation(normalizedQuery, operation.toUpperCase())) {
             return {
                 message: `This query contains a destructive operation: ${operation}`,
                 required: true,
@@ -25,7 +165,7 @@ export function requiresConfirmation(query, confirmationOperations) {
     return { required: false };
 }
 export function getQueryType(query) {
-    const normalizedQuery = query.trim().toUpperCase();
+    const normalizedQuery = normalize(query);
     const firstWord = normalizedQuery.split(/\s+/, 1)[0];
     const knownTypes = [
         'SELECT',
@@ -47,10 +187,10 @@ export function getQueryType(query) {
 }
 export function analyzeQuery(query) {
     const warnings = [];
-    const normalizedQuery = query.trim().toUpperCase();
+    const normalizedQuery = normalizeClauses(query);
     // Check for missing WHERE clause in UPDATE/DELETE
     if ((normalizedQuery.startsWith('UPDATE') || normalizedQuery.startsWith('DELETE')) &&
-        !normalizedQuery.includes('WHERE')) {
+        !containsOperation(normalizedQuery, 'WHERE')) {
         warnings.push({
             level: 'warning',
             message: 'Missing WHERE clause in UPDATE/DELETE query',
@@ -66,7 +206,7 @@ export function analyzeQuery(query) {
         });
     }
     // Check for missing LIMIT in SELECT
-    if (normalizedQuery.startsWith('SELECT') && !normalizedQuery.includes('LIMIT')) {
+    if (normalizedQuery.startsWith('SELECT') && !containsOperation(normalizedQuery, 'LIMIT')) {
         warnings.push({
             level: 'info',
             message: 'SELECT query without LIMIT',
@@ -76,9 +216,17 @@ export function analyzeQuery(query) {
     return warnings;
 }
 export function applyDefaultLimit(query, defaultLimit) {
-    const normalizedQuery = query.trim().toUpperCase();
-    if (normalizedQuery.startsWith('SELECT') && !normalizedQuery.includes('LIMIT')) {
-        return `${query.trim()} LIMIT ${defaultLimit}`;
+    const normalizedQuery = normalizeClauses(query);
+    if (!normalizedQuery.startsWith('SELECT') || containsOperation(normalizedQuery, 'LIMIT')) {
+        return query;
+    }
+    const terminator = findTrailingTerminator(query);
+    // On its own line either way: a trailing `-- comment` would otherwise swallow
+    // the LIMIT.
+    if (terminator === -1) {
+        return `${query.trim()}\nLIMIT ${defaultLimit}`;
     }
-    return query;
+    // The LIMIT has to go in front of the terminator. After it, MySQL reads
+    // `LIMIT 100` as a second statement and rejects the whole query.
+    return `${query.slice(0, terminator).trim()}\nLIMIT ${defaultLimit}\n${query.slice(terminator).trim()}`;
 }

package/oclif.manifest.json

@@ -689,5 +689,5 @@
       ]
     }
   },
-  "version": "0.6.1"
+  "version": "0.6.2"
 }

package/package.json

@@ -1,14 +1,14 @@
 {
   "name": "@hesed/mysql",
   "description": "CLI for MySQL database interaction",
-  "version": "0.6.1",
+  "version": "0.6.2",
   "author": "Hesed",
   "bin": {
     "mq": "./bin/run.js"
   },
   "bugs": "https://github.com/hesedcasa/mysql/issues",
   "dependencies": {
-    "@hesed/plugin-lib": "^0.12.1",
+    "@hesed/plugin-lib": "^0.12.3",
     "@inquirer/prompts": "^8.3.0",
     "@oclif/core": "^4",
     "@toon-format/toon": "^2.1.0",
@@ -24,7 +24,7 @@
     "@types/mocha": "^10",
     "@types/node": "^26",
     "@types/sinon": "^22.0.0",
-    "c8": "^11.0.0",
+    "c8": "^12.0.0",
     "chai": "^6",
     "eslint": "^10",
     "eslint-config-oclif": "^7",
@@ -69,13 +69,17 @@
     "postpack": "shx rm -f oclif.manifest.json",
     "posttest": "npm run lint",
     "prepack": "oclif manifest && oclif readme",
-    "test": "mocha --forbid-only \"test/**/*.test.ts\"",
+    "test": "mocha --forbid-only \"test/**/*.test.ts\" --ignore \"test/e2e/**\"",
     "test:coverage": "c8 npm test",
     "test:coverage:report": "c8 --reporter=html --reporter=text npm test",
     "version": "oclif readme && git add README.md",
     "find-deadcode": "ts-prune --ignore '(run|default)'",
     "format": "eslint --cache --fix --quiet . && prettier --write --cache .",
-    "pre-commit": "npm run format && npm run find-deadcode"
+    "pre-commit": "npm run format && npm run find-deadcode",
+    "test:e2e": "./scripts/e2e.sh",
+    "e2e:up": "docker compose -f docker/compose.yaml up -d --build --wait",
+    "e2e:down": "docker compose -f docker/compose.yaml down -v --remove-orphans",
+    "e2e:mocha": "mocha --forbid-only \"test/e2e/**/*.e2e.test.ts\""
   },
   "types": "dist/index.d.ts",
   "c8": {