@memberjunction/global 6.1.4 → 6.1.6

package/dist/SQLExpressionValidator.d.ts

@@ -10,6 +10,7 @@
  * @module @memberjunction/global/SQLExpressionValidator
  */
 import { BaseSingleton } from './BaseSingleton.js';
+import { SQLScreeningDialect } from './SQLScreeningScanner.js';
 /**
  * Dangerous SQL keywords that are never allowed in user-provided expressions
  */
@@ -26,34 +27,30 @@ export declare const FULL_QUERY_ALLOWED_KEYWORDS: readonly ["EXISTS", "ANY", "AL
  * a schema-enumeration and credential-exfiltration primitive
  * (e.g. `SELECT name, password_hash FROM sys.sql_logins`,
  *  `SELECT * FROM INFORMATION_SCHEMA.COLUMNS`, `SELECT * FROM pg_catalog.pg_authid`).
- * String literals are stripped before this check runs, so a literal value like `'sys.x'` is safe.
+ * The check reads {@link SQLScreeningScan.CodeWithIdentifiers}: string literals are removed, so a
+ * literal value like `'sys.x'` is safe, and quoted names are unwrapped, so `[sys].[x]` is caught.
  */
 export declare const BLOCKED_SYSTEM_OBJECT_PATTERNS: RegExp[];
 /**
- * Removes SQL string literals from a clause or expression so that a keyword denylist can be
- * applied to the *code* portion without tripping over keywords that appear inside quoted data
- * (e.g. `Comments LIKE '%--%'`).
+ * Replaces each SQL string literal with one space so that a keyword denylist can be applied to the
+ * rest without tripping over keywords inside quoted data (e.g. `Comments LIKE '%--%'`). Quoted
+ * identifiers and comments are left as written.
  *
- * 🚨 SECURITY — this is the single implementation of literal-stripping for MJ's SQL screens, and
- * it MUST stay byte-for-byte consistent with how the database parses literals. If the stripper
- * removes a span the database does NOT treat as a literal, everything hidden inside that span
- * bypasses the denylist while the database still executes it.
- *
- * An earlier version of this logic (duplicated in two places, which is how it survived) honored
- * **backslash escaping** — `/(['"])(?:(?=(\\?))\2[\s\S])*?\1/g`. SQL Server and PostgreSQL do not
- * treat `\` as an escape character, so `x = 'a\') ; DROP TABLE Users; --'` was swallowed whole as
- * one "literal" and stripped to `x = `, which passed every denylist — while the database closed
- * the literal at the real quote and executed the stacked statement.
- *
- * **Do NOT reintroduce backslash-escape handling here, and do NOT inline a second copy of this
- * regex anywhere else — call this function.**
+ * 🚨 SECURITY — literals are found by {@link ScanSQLForScreening}, which reads the text the way the
+ * database does: a quote inside a T-SQL `[…]` identifier, a comment or a PostgreSQL `$$…$$` string
+ * opens no literal, and a backslash escapes a quote only inside a PostgreSQL `E'…'` string. A
+ * stripper that removes a span the database does NOT treat as a literal hides everything inside it
+ * from the denylist while the database still runs it. Screens should call
+ * {@link ScanSQLForScreening} directly, which also reports comments and text it cannot classify.
  *
  * @param sql The clause, expression, or query to strip literals from
- * @returns The input with every complete string literal removed. An UNTERMINATED literal is left
- *          in place on purpose: the stray quote and everything after it stay visible to the
- *          denylist rather than being silently swallowed.
+ * @param dialect The dialect that will run the SQL. Without one, the text must read the same way
+ *                under every dialect the scanner knows.
+ * @returns The input with each string literal replaced by a space. The input is returned unchanged
+ *          when it cannot be classified (for example an unterminated literal) or when the dialects
+ *          disagree on where its literals are, so a denylist still sees all of it.
  */
-export declare function StripSQLStringLiterals(sql: string): string;
+export declare function StripSQLStringLiterals(sql: string, dialect?: SQLScreeningDialect): string;
 /**
  * Safe SQL functions allowed in expressions, organized by category
  */
@@ -101,6 +98,11 @@ export interface SQLValidationOptions {
     additionalAllowed?: string[];
     /** Custom blocked keywords to add */
     additionalBlocked?: string[];
+    /**
+     * The dialect that will run the SQL, which decides how quotes, identifiers and comments are read.
+     * Without one, the SQL must pass under every dialect {@link ScanSQLForScreening} knows.
+     */
+    Dialect?: SQLScreeningDialect;
 }
 /**
  * Central SQL expression validator for preventing SQL injection.
@@ -141,16 +143,20 @@ export declare class SQLExpressionValidator extends BaseSingleton<SQLExpressionV
      */
     validate(expression: string, options: SQLValidationOptions): SQLValidationResult;
     /**
-     * Remove string literals to avoid false positives in keyword detection.
+     * Runs every check against one dialect's reading of the expression.
      *
-     * 🚨 SECURITY: delegates to {@link StripSQLStringLiterals} — read the warning there before
-     * changing anything about how literals are matched. This must never grow its own regex again.
+     * 🚨 SECURITY: the checks read the scanner's projections, never the raw text. Do not add a regex
+     * that finds literals, identifiers or comments here; see {@link ScanSQLForScreening}.
      */
-    private removeStringLiterals;
+    private validateReading;
     /**
      * Check for dangerous SQL patterns that indicate injection attempts
      */
     private checkDangerousPatterns;
+    /**
+     * The keywords {@link checkDangerousPatterns} rejects in this context.
+     */
+    private blockedKeywords;
     /**
      * Check that function names are in the allowlist
      */
@@ -163,12 +169,6 @@ export declare class SQLExpressionValidator extends BaseSingleton<SQLExpressionV
      * Validate field references exist in entity (lenient mode - just for logging)
      */
     private checkFieldReferences;
-    /**
-     * Strip SQL comments (single-line -- and multi-line block comments) from a query.
-     * Used by full_query context to allow agent-generated header comments
-     * without triggering the comment injection check.
-     */
-    private stripSQLComments;
     /**
      * Escape special regex characters in a string
      */
@@ -186,7 +186,11 @@ export declare class SQLExpressionValidator extends BaseSingleton<SQLExpressionV
      * Validate a full SQL query (SELECT or WITH/CTE statement).
      * Blocks mutations, dangerous operations, and multi-statement injection.
      * Allows SELECT, subqueries, set operations, and SQL comments.
+     *
+     * @param sql The query to validate
+     * @param dialect The dialect that will run the query. Without one, the query must pass under
+     *                every dialect {@link ScanSQLForScreening} knows.
      */
-    validateFullQuery(sql: string): SQLValidationResult;
+    validateFullQuery(sql: string, dialect?: SQLScreeningDialect): SQLValidationResult;
 }
 //# sourceMappingURL=SQLExpressionValidator.d.ts.map

package/dist/SQLExpressionValidator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SQLExpressionValidator.d.ts","sourceRoot":"","sources":["../src/SQLExpressionValidator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD;;GAEG;AACH,eAAO,MAAM,sBAAsB,2gBA0CzB,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,2BAA2B,wFAe9B,CAAC;AAEX;;;;;;;;GAQG;AACH,eAAO,MAAM,8BAA8B,EAAE,MAAM,EAMlD,CAAC;AAcF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;CA2BxB,CAAC;AAEX;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAC5B,cAAc,GACd,UAAU,GACV,WAAW,GACX,iBAAiB,GACjB,YAAY,CAAC;AAEjB;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,+CAA+C;IAC/C,KAAK,EAAE,OAAO,CAAC;IACf,yCAAyC;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iCAAiC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,gDAAgD;IAChD,OAAO,EAAE,oBAAoB,CAAC;IAE9B,4EAA4E;IAC5E,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IAExB,wHAAwH;IACxH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B,iFAAiF;IACjF,eAAe,CAAC,EAAE,OAAO,CAAC;IAE1B,+CAA+C;IAC/C,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE7B,qCAAqC;IACrC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,sBAAuB,SAAQ,aAAa,CAAC,sBAAsB,CAAC;IAC/E;;OAEG;;IAKH;;OAEG;IACH,WAAkB,QAAQ,IAAI,sBAAsB,CAEnD;IAED;;;;;;OAMG;IACI,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,GAAG,mBAAmB;IAoCvF;;;;;OAKG;IACH,OAAO,CAAC,oBAAoB;IAI5B;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAkF9B;;OAEG;IACH,OAAO,CAAC,kBAAkB;IA2B1B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAiCzB;;OAEG;IACH,OAAO,CAAC,oBAAoB;IA4B5B;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAMxB;;OAEG;IACH,OAAO,CAAC,WAAW;IAInB;;;;;;;OAOG;IACH,OAAO,CAAC,sBAAsB;IAQ9B;;;;OAIG;IACI,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,mBAAmB;CAO3D"}
+{"version":3,"file":"SQLExpressionValidator.d.ts","sourceRoot":"","sources":["../src/SQLExpressionValidator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAGL,mBAAmB,EAGpB,MAAM,uBAAuB,CAAC;AAE/B;;GAEG;AACH,eAAO,MAAM,sBAAsB,2gBA0CzB,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,2BAA2B,wFAe9B,CAAC;AAEX;;;;;;;;;GASG;AACH,eAAO,MAAM,8BAA8B,EAAE,MAAM,EAMlD,CAAC;AAQF;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,mBAAmB,GAAG,MAAM,CAKzF;AAcD;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;CA2BxB,CAAC;AAEX;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAC5B,cAAc,GACd,UAAU,GACV,WAAW,GACX,iBAAiB,GACjB,YAAY,CAAC;AAEjB;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,+CAA+C;IAC/C,KAAK,EAAE,OAAO,CAAC;IACf,yCAAyC;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iCAAiC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,gDAAgD;IAChD,OAAO,EAAE,oBAAoB,CAAC;IAE9B,4EAA4E;IAC5E,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IAExB,wHAAwH;IACxH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B,iFAAiF;IACjF,eAAe,CAAC,EAAE,OAAO,CAAC;IAE1B,+CAA+C;IAC/C,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE7B,qCAAqC;IACrC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE7B;;;OAGG;IACH,OAAO,CAAC,EAAE,mBAAmB,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,sBAAuB,SAAQ,aAAa,CAAC,sBAAsB,CAAC;IAC/E;;OAEG;;IAKH;;OAEG;IACH,WAAkB,QAAQ,IAAI,sBAAsB,CAEnD;IAED;;;;;;OAMG;IACI,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,GAAG,mBAAmB;IAmBvF;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IA8BvB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IA0D9B;;OAEG;IACH,OAAO,CAAC,eAAe;IAsBvB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IA2B1B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IA+BzB;;OAEG;IACH,OAAO,CAAC,oBAAoB;IA4B5B;;OAEG;IACH,OAAO,CAAC,WAAW;IAInB;;;;;;;OAOG;IACH,OAAO,CAAC,sBAAsB;IAQ9B;;;;;;;;OAQG;IACI,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,mBAAmB,GAAG,mBAAmB;CAO1F"}

package/dist/SQLExpressionValidator.js

@@ -10,6 +10,7 @@
  * @module @memberjunction/global/SQLExpressionValidator
  */
 import { BaseSingleton } from './BaseSingleton.js';
+import { ScanSQLForScreening, SQL_SCREENING_DIALECTS, } from './SQLScreeningScanner.js';
 /**
  * Dangerous SQL keywords that are never allowed in user-provided expressions
  */
@@ -67,7 +68,8 @@ export const FULL_QUERY_ALLOWED_KEYWORDS = [
  * a schema-enumeration and credential-exfiltration primitive
  * (e.g. `SELECT name, password_hash FROM sys.sql_logins`,
  *  `SELECT * FROM INFORMATION_SCHEMA.COLUMNS`, `SELECT * FROM pg_catalog.pg_authid`).
- * String literals are stripped before this check runs, so a literal value like `'sys.x'` is safe.
+ * The check reads {@link SQLScreeningScan.CodeWithIdentifiers}: string literals are removed, so a
+ * literal value like `'sys.x'` is safe, and quoted names are unwrapped, so `[sys].[x]` is caught.
  */
 export const BLOCKED_SYSTEM_OBJECT_PATTERNS = [
     /\bSYS\s*\.\s*\w/i, // SQL Server system catalog schema: sys.sql_logins, sys.objects, sys.fn_*, ...
@@ -77,42 +79,47 @@ export const BLOCKED_SYSTEM_OBJECT_PATTERNS = [
     /\bPG_(AUTHID|SHADOW|USER|ROLES)\b/i, // PostgreSQL credential / role catalogs
 ];
 /**
- * Matches SQL string literals the way SQL Server and PostgreSQL (with the default
- * `standard_conforming_strings=on`) actually parse them: a literal is closed by the next
- * single quote, `''` is an embedded quote, and a backslash is an ORDINARY character that
- * does NOT escape the closing quote. Double-quoted runs are matched with the same doubling
- * rule so a delimited identifier can't hide a payload either.
- *
- * @see StripSQLStringLiterals — use that, not this constant, so every caller gets the
- * documented semantics and the two validators in MJ can never drift apart again.
+ * The keywords a full query may open with. Without the `u` flag, the `i` flag matches ASCII letters
+ * only, so no other letter is case-mapped to S, E, L, C, T, W, I or H.
  */
-const SQL_STRING_LITERAL_PATTERN = /'(?:[^']|'')*'|"(?:[^"]|"")*"/g;
+const FULL_QUERY_OPENING_KEYWORD = /^(?:SELECT|WITH)$/i;
 /**
- * Removes SQL string literals from a clause or expression so that a keyword denylist can be
- * applied to the *code* portion without tripping over keywords that appear inside quoted data
- * (e.g. `Comments LIKE '%--%'`).
- *
- * 🚨 SECURITY — this is the single implementation of literal-stripping for MJ's SQL screens, and
- * it MUST stay byte-for-byte consistent with how the database parses literals. If the stripper
- * removes a span the database does NOT treat as a literal, everything hidden inside that span
- * bypasses the denylist while the database still executes it.
- *
- * An earlier version of this logic (duplicated in two places, which is how it survived) honored
- * **backslash escaping** — `/(['"])(?:(?=(\\?))\2[\s\S])*?\1/g`. SQL Server and PostgreSQL do not
- * treat `\` as an escape character, so `x = 'a\') ; DROP TABLE Users; --'` was swallowed whole as
- * one "literal" and stripped to `x = `, which passed every denylist — while the database closed
- * the literal at the real quote and executed the stacked statement.
+ * Replaces each SQL string literal with one space so that a keyword denylist can be applied to the
+ * rest without tripping over keywords inside quoted data (e.g. `Comments LIKE '%--%'`). Quoted
+ * identifiers and comments are left as written.
  *
- * **Do NOT reintroduce backslash-escape handling here, and do NOT inline a second copy of this
- * regex anywhere else — call this function.**
+ * 🚨 SECURITY — literals are found by {@link ScanSQLForScreening}, which reads the text the way the
+ * database does: a quote inside a T-SQL `[…]` identifier, a comment or a PostgreSQL `$$…$$` string
+ * opens no literal, and a backslash escapes a quote only inside a PostgreSQL `E'…'` string. A
+ * stripper that removes a span the database does NOT treat as a literal hides everything inside it
+ * from the denylist while the database still runs it. Screens should call
+ * {@link ScanSQLForScreening} directly, which also reports comments and text it cannot classify.
  *
  * @param sql The clause, expression, or query to strip literals from
- * @returns The input with every complete string literal removed. An UNTERMINATED literal is left
- *          in place on purpose: the stray quote and everything after it stay visible to the
- *          denylist rather than being silently swallowed.
+ * @param dialect The dialect that will run the SQL. Without one, the text must read the same way
+ *                under every dialect the scanner knows.
+ * @returns The input with each string literal replaced by a space. The input is returned unchanged
+ *          when it cannot be classified (for example an unterminated literal) or when the dialects
+ *          disagree on where its literals are, so a denylist still sees all of it.
  */
-export function StripSQLStringLiterals(sql) {
-    return sql.replace(SQL_STRING_LITERAL_PATTERN, '');
+export function StripSQLStringLiterals(sql, dialect) {
+    const scans = (dialect ? [dialect] : SQL_SCREENING_DIALECTS).map(d => ScanSQLForScreening(sql, d));
+    if (scans.some(scan => !scan.Classified))
+        return sql;
+    const readings = scans.map(scan => replaceStringSpans(sql, scan.Spans));
+    return readings.every(reading => reading === readings[0]) ? readings[0] : sql;
+}
+/** Writes `sql` with each string span replaced by one space. */
+function replaceStringSpans(sql, spans) {
+    let result = '';
+    let from = 0;
+    for (const span of spans) {
+        if (span.Kind !== 'string')
+            continue;
+        result += sql.slice(from, span.Start) + ' ';
+        from = span.End;
+    }
+    return result + sql.slice(from);
 }
 /**
  * Safe SQL functions allowed in expressions, organized by category
@@ -186,75 +193,65 @@ export class SQLExpressionValidator extends BaseSingleton {
         if (!trimmed) {
             return { valid: false, error: 'Expression cannot be empty' };
         }
-        // Step 1: Remove string literals to avoid false positives
-        const withoutStrings = this.removeStringLiterals(trimmed);
-        // Step 2: Check for dangerous patterns
-        const dangerCheck = this.checkDangerousPatterns(withoutStrings, options);
+        // Read the text the way the database will. When the dialect is unknown, every reading must pass.
+        const dialects = options.Dialect ? [options.Dialect] : SQL_SCREENING_DIALECTS;
+        for (const dialect of dialects) {
+            const result = this.validateReading(ScanSQLForScreening(trimmed, dialect), options);
+            if (!result.valid)
+                return result;
+        }
+        return { valid: true };
+    }
+    /**
+     * Runs every check against one dialect's reading of the expression.
+     *
+     * 🚨 SECURITY: the checks read the scanner's projections, never the raw text. Do not add a regex
+     * that finds literals, identifiers or comments here; see {@link ScanSQLForScreening}.
+     */
+    validateReading(scan, options) {
+        if (!scan.Classified) {
+            return {
+                valid: false,
+                error: `SQL could not be read safely as ${scan.Dialect}: ${scan.Error}`,
+                trigger: 'unclassified'
+            };
+        }
+        const dangerCheck = this.checkDangerousPatterns(scan, options);
         if (!dangerCheck.valid)
             return dangerCheck;
-        // Step 3: Validate function names are in allowlist (skip for full queries —
-        // the function allowlist is designed for expression fragments, not full SQL statements)
+        // The function allowlist is designed for expression fragments, not full SQL statements.
+        // Quoted names are unwrapped, so a quoted function call is checked too.
         if (options.context !== 'full_query') {
-            const functionCheck = this.checkFunctionNames(withoutStrings, options);
+            const functionCheck = this.checkFunctionNames(scan.CodeWithIdentifiers, options);
             if (!functionCheck.valid)
                 return functionCheck;
         }
-        // Step 4: Context-specific validation
-        const contextCheck = this.checkContextRules(withoutStrings, options);
+        const contextCheck = this.checkContextRules(scan, options);
         if (!contextCheck.valid)
             return contextCheck;
-        // Step 5: Optional field reference validation (lenient - just logs warnings)
+        // Optional field reference validation (lenient - just logs warnings)
         if (options.entityFields?.length) {
-            this.checkFieldReferences(withoutStrings, options.entityFields);
+            this.checkFieldReferences(scan.Code, options.entityFields);
         }
         return { valid: true };
     }
-    /**
-     * Remove string literals to avoid false positives in keyword detection.
-     *
-     * 🚨 SECURITY: delegates to {@link StripSQLStringLiterals} — read the warning there before
-     * changing anything about how literals are matched. This must never grow its own regex again.
-     */
-    removeStringLiterals(expression) {
-        return StripSQLStringLiterals(expression);
-    }
     /**
      * Check for dangerous SQL patterns that indicate injection attempts
      */
-    checkDangerousPatterns(expression, options) {
+    checkDangerousPatterns(scan, options) {
         const isFullQuery = options.context === 'full_query';
-        // Build blocked list - explicitly typed as string[] for mutability
-        let blocked = [...DANGEROUS_SQL_KEYWORDS];
-        if (options.additionalBlocked) {
-            blocked.push(...options.additionalBlocked);
-        }
-        // For full_query context, remove keywords that are legitimate in SELECT statements
-        if (isFullQuery) {
-            const allowedSet = new Set(FULL_QUERY_ALLOWED_KEYWORDS.map(k => k.toUpperCase()));
-            blocked = blocked.filter(kw => !allowedSet.has(kw.toUpperCase()));
-        }
-        // Add SELECT to blocked unless context allows it (prevents subqueries in expressions)
-        if (!isFullQuery && !options.allowSubqueries && !blocked.includes('SELECT')) {
-            blocked.push('SELECT');
-        }
-        // For full_query, strip comments before keyword checking (agent SQL has header comment blocks).
-        // For expressions, comments are still rejected outright as injection vectors.
-        let textToCheck;
-        if (isFullQuery) {
-            textToCheck = this.stripSQLComments(expression).toUpperCase();
-        }
-        else {
-            const upper = expression.toUpperCase();
-            if (upper.includes('--') || upper.includes('/*') || upper.includes('*/')) {
-                return {
-                    valid: false,
-                    error: 'Comments are not allowed in SQL expressions',
-                    trigger: 'comment'
-                };
-            }
-            textToCheck = upper;
+        const textToCheck = scan.Code.toUpperCase();
+        // Full queries may carry comments (agent SQL has header comment blocks); the scan has already
+        // blanked them. In expressions, comments are rejected outright as injection vectors, and so is
+        // a stray `*/`, which is code.
+        if (!isFullQuery && (scan.CommentCount > 0 || textToCheck.includes('*/'))) {
+            return {
+                valid: false,
+                error: 'Comments are not allowed in SQL expressions',
+                trigger: 'comment'
+            };
         }
-        for (const keyword of blocked) {
+        for (const keyword of this.blockedKeywords(options)) {
             // Use word boundaries to avoid false positives (e.g., "DESCRIPTION" containing "EXEC")
             const pattern = new RegExp(`\\b${this.escapeRegex(keyword)}\\b`, 'i');
             if (pattern.test(textToCheck)) {
@@ -269,9 +266,10 @@ export class SQLExpressionValidator extends BaseSingleton {
         // Block references to database system catalogs / metadata objects in ALL contexts
         // (including full_query). These live outside MemberJunction's entity-permission model, so
         // permitting them turns a validated SELECT into a schema-enumeration / credential-exfiltration
-        // primitive. String literals were already stripped upstream, so legitimate literal values are safe.
+        // primitive. Literals are blanked and quoted names unwrapped, so `[sys].[x]` is caught too.
+        const namesToCheck = scan.CodeWithIdentifiers.toUpperCase();
         for (const sysPattern of BLOCKED_SYSTEM_OBJECT_PATTERNS) {
-            if (sysPattern.test(textToCheck)) {
+            if (sysPattern.test(namesToCheck)) {
                 return {
                     valid: false,
                     error: 'Access to database system catalogs / metadata objects is not allowed',
@@ -279,13 +277,10 @@ export class SQLExpressionValidator extends BaseSingleton {
                 };
             }
         }
-        // Check statement terminator (prevents multi-statement injection).
-        // For full_query context, strip comments first (a trailing semicolon may be followed by
-        // an inline comment like `ORDER BY x DESC; -- highest first`), then strip the trailing
-        // semicolon. Only reject if semicolons remain mid-statement, indicating injection.
-        const textForSemicolonCheck = isFullQuery
-            ? this.stripSQLComments(expression).replace(/;\s*$/, '') // strip comments then trailing semicolon
-            : expression;
+        // Check statement terminator (prevents multi-statement injection). Comments are already
+        // blanked, so a full query may end with one semicolon even when a comment follows it
+        // (`ORDER BY x DESC; -- highest first`). A semicolon anywhere else indicates injection.
+        const textForSemicolonCheck = isFullQuery ? textToCheck.replace(/;\s*$/, '') : textToCheck;
         if (textForSemicolonCheck.includes(';')) {
             return {
                 valid: false,
@@ -295,6 +290,27 @@ export class SQLExpressionValidator extends BaseSingleton {
         }
         return { valid: true };
     }
+    /**
+     * The keywords {@link checkDangerousPatterns} rejects in this context.
+     */
+    blockedKeywords(options) {
+        const isFullQuery = options.context === 'full_query';
+        // Build blocked list - explicitly typed as string[] for mutability
+        let blocked = [...DANGEROUS_SQL_KEYWORDS];
+        if (options.additionalBlocked) {
+            blocked.push(...options.additionalBlocked);
+        }
+        // For full_query context, remove keywords that are legitimate in SELECT statements
+        if (isFullQuery) {
+            const allowedSet = new Set(FULL_QUERY_ALLOWED_KEYWORDS.map(k => k.toUpperCase()));
+            blocked = blocked.filter(kw => !allowedSet.has(kw.toUpperCase()));
+        }
+        // Add SELECT to blocked unless context allows it (prevents subqueries in expressions)
+        if (!isFullQuery && !options.allowSubqueries && !blocked.includes('SELECT')) {
+            blocked.push('SELECT');
+        }
+        return blocked;
+    }
     /**
      * Check that function names are in the allowlist
      */
@@ -324,12 +340,12 @@ export class SQLExpressionValidator extends BaseSingleton {
     /**
      * Context-specific validation rules
      */
-    checkContextRules(expression, options) {
+    checkContextRules(scan, options) {
         // For aggregate context, require at least one aggregate function (unless explicitly disabled)
         if (options.context === 'aggregate' && options.requireAggregate !== false) {
             const hasAggregate = ALLOWED_SQL_FUNCTIONS.aggregates.some(fn => {
                 const pattern = new RegExp(`\\b${fn}\\s*\\(`, 'i');
-                return pattern.test(expression);
+                return pattern.test(scan.Code);
             });
             if (!hasAggregate) {
                 return {
@@ -339,17 +355,15 @@ export class SQLExpressionValidator extends BaseSingleton {
                 };
             }
         }
-        // For full_query context, the query must start with SELECT or WITH (CTE)
-        if (options.context === 'full_query') {
-            const stripped = this.stripSQLComments(expression).trim();
-            const upper = stripped.toUpperCase();
-            if (!upper.startsWith('SELECT') && !upper.startsWith('WITH')) {
-                return {
-                    valid: false,
-                    error: 'Ad-hoc query must start with SELECT or WITH',
-                    suggestion: 'Only SELECT statements and CTEs (WITH ... AS) are allowed'
-                };
-            }
+        // For full_query context, the first token (after comments) must be the unquoted keyword SELECT or
+        // WITH, compared in ASCII. SQL Server runs a batch that opens with any other name, quoted or not,
+        // as a procedure call.
+        if (options.context === 'full_query' && !FULL_QUERY_OPENING_KEYWORD.test(scan.LeadingWord ?? '')) {
+            return {
+                valid: false,
+                error: 'Ad-hoc query must start with SELECT or WITH',
+                suggestion: 'Only SELECT statements and CTEs (WITH ... AS) are allowed'
+            };
         }
         return { valid: true };
     }
@@ -379,16 +393,6 @@ export class SQLExpressionValidator extends BaseSingleton {
             // For now, we allow it to pass
         }
     }
-    /**
-     * Strip SQL comments (single-line -- and multi-line block comments) from a query.
-     * Used by full_query context to allow agent-generated header comments
-     * without triggering the comment injection check.
-     */
-    stripSQLComments(sql) {
-        return sql
-            .replace(/--[^\n]*/g, '') // Single-line comments
-            .replace(/\/\*[\s\S]*?\*\//g, ''); // Block comments
-    }
     /**
      * Escape special regex characters in a string
      */
@@ -414,13 +418,17 @@ export class SQLExpressionValidator extends BaseSingleton {
      * Validate a full SQL query (SELECT or WITH/CTE statement).
      * Blocks mutations, dangerous operations, and multi-statement injection.
      * Allows SELECT, subqueries, set operations, and SQL comments.
+     *
+     * @param sql The query to validate
+     * @param dialect The dialect that will run the query. Without one, the query must pass under
+     *                every dialect {@link ScanSQLForScreening} knows.
      */
-    validateFullQuery(sql) {
+    validateFullQuery(sql, dialect) {
         // Normalize literal escape sequences before validation — agent-generated
         // SQL may arrive with literal \n instead of real newlines, which breaks
         // comment stripping and the "must start with SELECT" check.
         const normalized = this.normalizeSQLWhitespace(sql);
-        return this.validate(normalized, { context: 'full_query' });
+        return this.validate(normalized, { context: 'full_query', Dialect: dialect });
     }
 }
 //# sourceMappingURL=SQLExpressionValidator.js.map

package/dist/SQLExpressionValidator.js.map

@@ -1 +1 @@
-{"version":3,"file":"SQLExpressionValidator.js","sourceRoot":"","sources":["../src/SQLExpressionValidator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,iCAAiC;IACjC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ;IAE/C,mCAAmC;IACnC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS;IAEhD,8BAA8B;IAC9B,OAAO,EAAE,QAAQ,EAAE,MAAM;IAEzB,2BAA2B;IAC3B,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU;IAElD,sBAAsB;IACtB,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW;IAE1C,6BAA6B;IAC7B,KAAK,EAAE,UAAU,EAAE,QAAQ;IAE3B,0CAA0C;IAC1C,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;IAEpC,2CAA2C;IAC3C,OAAO,EAAE,WAAW,EAAE,QAAQ;IAE9B,4CAA4C;IAC5C,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM;IAE9B,2BAA2B;IAC3B,MAAM,EAAE,YAAY,EAAE,gBAAgB,EAAE,WAAW;IAEnD,6BAA6B;IAC7B,KAAK,EAAE,KAAK;IAEZ,cAAc;IACd,SAAS,EAAE,SAAS,EAAE,YAAY;IAElC,uBAAuB;IACvB,SAAS,EAAE,OAAO,EAAE,OAAO;IAE3B,oBAAoB;IACpB,UAAU,EAAE,aAAa;CACjB,CAAC;AAEX;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,gEAAgE;IAChE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM;IAE9B,4DAA4D;IAC5D,OAAO,EAAE,WAAW,EAAE,QAAQ;IAE9B,0DAA0D;IAC1D,IAAI;IAEJ,yEAAyE;IACzE,yEAAyE;IACzE,8EAA8E;IAC9E,mEAAmE;IACnE,KAAK;CACG,CAAC;AAEX;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAa;IACtD,kBAAkB,EAAuB,+EAA+E;IACxH,yBAAyB,EAAgB,uDAAuD;IAChG,gBAAgB,EAAyB,gCAAgC;IACzE,oBAAoB,EAAqB,mCAAmC;IAC5E,oCAAoC,EAAK,wCAAwC;CAClF,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,0BAA0B,GAAG,gCAAgC,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,OAAO,GAAG,CAAC,OAAO,CAAC,0BAA0B,EAAE,EAAE,CAAC,CAAC;AACrD,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,sBAAsB;IACtB,UAAU,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,cAAc,CAAC;IAE9H,iBAAiB;IACjB,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC;IAElG,+BAA+B;IAC/B,MAAM,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC;IAE9I,iBAAiB;IACjB,IAAI,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,CAAC;IAEhJ,gCAAgC;IAChC,UAAU,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,CAAC;IAEpE,gBAAgB;IAChB,YAAY,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC;IAErD,mBAAmB;IACnB,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC;IAEpD,kCAAkC;IAClC,OAAO,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC;IAEpE,2BAA2B;IAC3B,QAAQ,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,CAAC;CAC1J,CAAC;AAiDX;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,OAAO,sBAAuB,SAAQ,aAAqC;IAC/E;;OAEG;IACH;QACE,KAAK,EAAE,CAAC;IACV,CAAC;IAED;;OAEG;IACI,MAAM,KAAK,QAAQ;QACxB,OAAO,sBAAsB,CAAC,WAAW,EAA0B,CAAC;IACtE,CAAC;IAED;;;;;;OAMG;IACI,QAAQ,CAAC,UAAkB,EAAE,OAA6B;QAC/D,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YAClD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;QAC/D,CAAC;QAED,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;QAC/D,CAAC;QAED,0DAA0D;QAC1D,MAAM,cAAc,GAAG,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAE1D,uCAAuC;QACvC,MAAM,WAAW,GAAG,IAAI,CAAC,sBAAsB,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QACzE,IAAI,CAAC,WAAW,CAAC,KAAK;YAAE,OAAO,WAAW,CAAC;QAE3C,4EAA4E;QAC5E,wFAAwF;QACxF,IAAI,OAAO,CAAC,OAAO,KAAK,YAAY,EAAE,CAAC;YACrC,MAAM,aAAa,GAAG,IAAI,CAAC,kBAAkB,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;YACvE,IAAI,CAAC,aAAa,CAAC,KAAK;gBAAE,OAAO,aAAa,CAAC;QACjD,CAAC;QAED,sCAAsC;QACtC,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QACrE,IAAI,CAAC,YAAY,CAAC,KAAK;YAAE,OAAO,YAAY,CAAC;QAE7C,6EAA6E;QAC7E,IAAI,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;YACjC,IAAI,CAAC,oBAAoB,CAAC,cAAc,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QAClE,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED;;;;;OAKG;IACK,oBAAoB,CAAC,UAAkB;QAC7C,OAAO,sBAAsB,CAAC,UAAU,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACK,sBAAsB,CAAC,UAAkB,EAAE,OAA6B;QAC9E,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,KAAK,YAAY,CAAC;QAErD,mEAAmE;QACnE,IAAI,OAAO,GAAa,CAAC,GAAG,sBAAsB,CAAC,CAAC;QACpD,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;YAC9B,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC7C,CAAC;QAED,mFAAmF;QACnF,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAClF,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QACpE,CAAC;QAED,sFAAsF;QACtF,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,eAAe,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5E,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC;QAED,gGAAgG;QAChG,8EAA8E;QAC9E,IAAI,WAAmB,CAAC;QACxB,IAAI,WAAW,EAAE,CAAC;YAChB,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;QAChE,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;YACvC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzE,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,KAAK,EAAE,6CAA6C;oBACpD,OAAO,EAAE,SAAS;iBACnB,CAAC;YACJ,CAAC;YACD,WAAW,GAAG,KAAK,CAAC;QACtB,CAAC;QAED,KAAK,MAAM,OAAO,IAAI,OAAO,EAAE,CAAC;YAC9B,uFAAuF;YACvF,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACtE,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC9B,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,KAAK,EAAE,mCAAmC,OAAO,EAAE;oBACnD,OAAO,EAAE,OAAO;oBAChB,UAAU,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,8DAA8D,CAAC,CAAC,CAAC,SAAS;iBAC9G,CAAC;YACJ,CAAC;QACH,CAAC;QAED,kFAAkF;QAClF,0FAA0F;QAC1F,+FAA+F;QAC/F,oGAAoG;QACpG,KAAK,MAAM,UAAU,IAAI,8BAA8B,EAAE,CAAC;YACxD,IAAI,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBACjC,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,KAAK,EAAE,sEAAsE;oBAC7E,OAAO,EAAE,eAAe;iBACzB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,mEAAmE;QACnE,wFAAwF;QACxF,uFAAuF;QACvF,mFAAmF;QACnF,MAAM,qBAAqB,GAAG,WAAW;YACvC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAG,yCAAyC;YACpG,CAAC,CAAC,UAAU,CAAC;QACf,IAAI,qBAAqB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,+CAA+C;gBACtD,OAAO,EAAE,GAAG;aACb,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED;;OAEG;IACK,kBAAkB,CAAC,UAAkB,EAAE,OAA6B;QAC1E,0DAA0D;QAC1D,MAAM,eAAe,GAAG,6BAA6B,CAAC;QACtD,IAAI,KAAK,CAAC;QAEV,mDAAmD;QACnD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QACzF,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;YAC9B,OAAO,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QACzE,CAAC;QAED,OAAO,CAAC,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC3D,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACtC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzB,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,KAAK,EAAE,aAAa,MAAM,kBAAkB;oBAC5C,OAAO,EAAE,MAAM;oBACf,UAAU,EAAE,8BAA8B,qBAAqB,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;iBACjJ,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED;;OAEG;IACK,iBAAiB,CAAC,UAAkB,EAAE,OAA6B;QACzE,8FAA8F;QAC9F,IAAI,OAAO,CAAC,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,gBAAgB,KAAK,KAAK,EAAE,CAAC;YAC1E,MAAM,YAAY,GAAG,qBAAqB,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;gBAC9D,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;gBACnD,OAAO,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAClC,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,KAAK,EAAE,mEAAmE;oBAC1E,UAAU,EAAE,eAAe,qBAAqB,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iBACzE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,IAAI,OAAO,CAAC,OAAO,KAAK,YAAY,EAAE,CAAC;YACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1D,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;YACrC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7D,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,KAAK,EAAE,6CAA6C;oBACpD,UAAU,EAAE,2DAA2D;iBACxE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED;;OAEG;IACK,oBAAoB,CAAC,UAAkB,EAAE,YAAsB;QACrE,oEAAoE;QACpE,MAAM,YAAY,GAAG,mCAAmC,CAAC;QACzD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAEjE,yDAAyD;QACzD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAE1F,IAAI,KAAK,CAAC;QACV,MAAM,aAAa,GAAa,EAAE,CAAC;QAEnC,OAAO,CAAC,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACxD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACpC,mDAAmD;YACnD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjD,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QAED,yDAAyD;QACzD,0EAA0E;QAC1E,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,0DAA0D;YAC1D,+BAA+B;QACjC,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,gBAAgB,CAAC,GAAW;QAClC,OAAO,GAAG;aACP,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAU,uBAAuB;aACzD,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,CAAC,iBAAiB;IACxD,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,GAAW;QAC7B,OAAO,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;IAED;;;;;;;OAOG;IACK,sBAAsB,CAAC,GAAW;QACxC,OAAO,GAAG;aACP,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAE,yBAAyB;aACnD,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAK,uBAAuB;aACjD,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAK,+BAA+B;aACzD,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAI,mBAAmB;IAClD,CAAC;IAED;;;;OAIG;IACI,iBAAiB,CAAC,GAAW;QAClC,yEAAyE;QACzE,wEAAwE;QACxE,4DAA4D;QAC5D,MAAM,UAAU,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;IAC9D,CAAC;CACF"}
+{"version":3,"file":"SQLExpressionValidator.js","sourceRoot":"","sources":["../src/SQLExpressionValidator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EACL,mBAAmB,EACnB,sBAAsB,GAIvB,MAAM,uBAAuB,CAAC;AAE/B;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,iCAAiC;IACjC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ;IAE/C,mCAAmC;IACnC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS;IAEhD,8BAA8B;IAC9B,OAAO,EAAE,QAAQ,EAAE,MAAM;IAEzB,2BAA2B;IAC3B,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU;IAElD,sBAAsB;IACtB,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW;IAE1C,6BAA6B;IAC7B,KAAK,EAAE,UAAU,EAAE,QAAQ;IAE3B,0CAA0C;IAC1C,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;IAEpC,2CAA2C;IAC3C,OAAO,EAAE,WAAW,EAAE,QAAQ;IAE9B,4CAA4C;IAC5C,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM;IAE9B,2BAA2B;IAC3B,MAAM,EAAE,YAAY,EAAE,gBAAgB,EAAE,WAAW;IAEnD,6BAA6B;IAC7B,KAAK,EAAE,KAAK;IAEZ,cAAc;IACd,SAAS,EAAE,SAAS,EAAE,YAAY;IAElC,uBAAuB;IACvB,SAAS,EAAE,OAAO,EAAE,OAAO;IAE3B,oBAAoB;IACpB,UAAU,EAAE,aAAa;CACjB,CAAC;AAEX;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,gEAAgE;IAChE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM;IAE9B,4DAA4D;IAC5D,OAAO,EAAE,WAAW,EAAE,QAAQ;IAE9B,0DAA0D;IAC1D,IAAI;IAEJ,yEAAyE;IACzE,yEAAyE;IACzE,8EAA8E;IAC9E,mEAAmE;IACnE,KAAK;CACG,CAAC;AAEX;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAa;IACtD,kBAAkB,EAAuB,+EAA+E;IACxH,yBAAyB,EAAgB,uDAAuD;IAChG,gBAAgB,EAAyB,gCAAgC;IACzE,oBAAoB,EAAqB,mCAAmC;IAC5E,oCAAoC,EAAK,wCAAwC;CAClF,CAAC;AAEF;;;GAGG;AACH,MAAM,0BAA0B,GAAG,oBAAoB,CAAC;AAExD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAW,EAAE,OAA6B;IAC/E,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,mBAAmB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IACnG,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,GAAG,CAAC;IACrD,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACxE,OAAO,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AAChF,CAAC;AAED,gEAAgE;AAChE,SAAS,kBAAkB,CAAC,GAAW,EAAE,KAAyB;IAChE,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ;YAAE,SAAS;QACrC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC;QAC5C,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;IACD,OAAO,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,sBAAsB;IACtB,UAAU,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,cAAc,CAAC;IAE9H,iBAAiB;IACjB,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC;IAElG,+BAA+B;IAC/B,MAAM,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC;IAE9I,iBAAiB;IACjB,IAAI,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,CAAC;IAEhJ,gCAAgC;IAChC,UAAU,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,CAAC;IAEpE,gBAAgB;IAChB,YAAY,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC;IAErD,mBAAmB;IACnB,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC;IAEpD,kCAAkC;IAClC,OAAO,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC;IAEpE,2BAA2B;IAC3B,QAAQ,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,CAAC;CAC1J,CAAC;AAuDX;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,OAAO,sBAAuB,SAAQ,aAAqC;IAC/E;;OAEG;IACH;QACE,KAAK,EAAE,CAAC;IACV,CAAC;IAED;;OAEG;IACI,MAAM,KAAK,QAAQ;QACxB,OAAO,sBAAsB,CAAC,WAAW,EAA0B,CAAC;IACtE,CAAC;IAED;;;;;;OAMG;IACI,QAAQ,CAAC,UAAkB,EAAE,OAA6B;QAC/D,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YAClD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;QAC/D,CAAC;QAED,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;QAC/D,CAAC;QAED,iGAAiG;QACjG,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC;QAC9E,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;YACpF,IAAI,CAAC,MAAM,CAAC,KAAK;gBAAE,OAAO,MAAM,CAAC;QACnC,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED;;;;;OAKG;IACK,eAAe,CAAC,IAAsB,EAAE,OAA6B;QAC3E,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,mCAAmC,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,KAAK,EAAE;gBACvE,OAAO,EAAE,cAAc;aACxB,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,sBAAsB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC/D,IAAI,CAAC,WAAW,CAAC,KAAK;YAAE,OAAO,WAAW,CAAC;QAE3C,wFAAwF;QACxF,wEAAwE;QACxE,IAAI,OAAO,CAAC,OAAO,KAAK,YAAY,EAAE,CAAC;YACrC,MAAM,aAAa,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;YACjF,IAAI,CAAC,aAAa,CAAC,KAAK;gBAAE,OAAO,aAAa,CAAC;QACjD,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC3D,IAAI,CAAC,YAAY,CAAC,KAAK;YAAE,OAAO,YAAY,CAAC;QAE7C,qEAAqE;QACrE,IAAI,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;YACjC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED;;OAEG;IACK,sBAAsB,CAAC,IAAsB,EAAE,OAA6B;QAClF,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,KAAK,YAAY,CAAC;QACrD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAE5C,8FAA8F;QAC9F,+FAA+F;QAC/F,+BAA+B;QAC/B,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,YAAY,GAAG,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC1E,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,6CAA6C;gBACpD,OAAO,EAAE,SAAS;aACnB,CAAC;QACJ,CAAC;QAED,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;YACpD,uFAAuF;YACvF,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACtE,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC9B,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,KAAK,EAAE,mCAAmC,OAAO,EAAE;oBACnD,OAAO,EAAE,OAAO;oBAChB,UAAU,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,8DAA8D,CAAC,CAAC,CAAC,SAAS;iBAC9G,CAAC;YACJ,CAAC;QACH,CAAC;QAED,kFAAkF;QAClF,0FAA0F;QAC1F,+FAA+F;QAC/F,4FAA4F;QAC5F,MAAM,YAAY,GAAG,IAAI,CAAC,mBAAmB,CAAC,WAAW,EAAE,CAAC;QAC5D,KAAK,MAAM,UAAU,IAAI,8BAA8B,EAAE,CAAC;YACxD,IAAI,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;gBAClC,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,KAAK,EAAE,sEAAsE;oBAC7E,OAAO,EAAE,eAAe;iBACzB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,wFAAwF;QACxF,qFAAqF;QACrF,wFAAwF;QACxF,MAAM,qBAAqB,GAAG,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;QAC3F,IAAI,qBAAqB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,+CAA+C;gBACtD,OAAO,EAAE,GAAG;aACb,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED;;OAEG;IACK,eAAe,CAAC,OAA6B;QACnD,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,KAAK,YAAY,CAAC;QAErD,mEAAmE;QACnE,IAAI,OAAO,GAAa,CAAC,GAAG,sBAAsB,CAAC,CAAC;QACpD,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;YAC9B,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC7C,CAAC;QAED,mFAAmF;QACnF,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAClF,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QACpE,CAAC;QAED,sFAAsF;QACtF,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,eAAe,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5E,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACK,kBAAkB,CAAC,UAAkB,EAAE,OAA6B;QAC1E,0DAA0D;QAC1D,MAAM,eAAe,GAAG,6BAA6B,CAAC;QACtD,IAAI,KAAK,CAAC;QAEV,mDAAmD;QACnD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QACzF,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;YAC9B,OAAO,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QACzE,CAAC;QAED,OAAO,CAAC,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC3D,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACtC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzB,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,KAAK,EAAE,aAAa,MAAM,kBAAkB;oBAC5C,OAAO,EAAE,MAAM;oBACf,UAAU,EAAE,8BAA8B,qBAAqB,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;iBACjJ,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED;;OAEG;IACK,iBAAiB,CAAC,IAAsB,EAAE,OAA6B;QAC7E,8FAA8F;QAC9F,IAAI,OAAO,CAAC,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,gBAAgB,KAAK,KAAK,EAAE,CAAC;YAC1E,MAAM,YAAY,GAAG,qBAAqB,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;gBAC9D,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;gBACnD,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjC,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,KAAK,EAAE,mEAAmE;oBAC1E,UAAU,EAAE,eAAe,qBAAqB,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iBACzE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,kGAAkG;QAClG,kGAAkG;QAClG,uBAAuB;QACvB,IAAI,OAAO,CAAC,OAAO,KAAK,YAAY,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC;YACjG,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,6CAA6C;gBACpD,UAAU,EAAE,2DAA2D;aACxE,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED;;OAEG;IACK,oBAAoB,CAAC,UAAkB,EAAE,YAAsB;QACrE,oEAAoE;QACpE,MAAM,YAAY,GAAG,mCAAmC,CAAC;QACzD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAEjE,yDAAyD;QACzD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAE1F,IAAI,KAAK,CAAC;QACV,MAAM,aAAa,GAAa,EAAE,CAAC;QAEnC,OAAO,CAAC,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACxD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACpC,mDAAmD;YACnD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjD,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QAED,yDAAyD;QACzD,0EAA0E;QAC1E,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,0DAA0D;YAC1D,+BAA+B;QACjC,CAAC;IACH,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,GAAW;QAC7B,OAAO,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;IAED;;;;;;;OAOG;IACK,sBAAsB,CAAC,GAAW;QACxC,OAAO,GAAG;aACP,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAE,yBAAyB;aACnD,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAK,uBAAuB;aACjD,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAK,+BAA+B;aACzD,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAI,mBAAmB;IAClD,CAAC;IAED;;;;;;;;OAQG;IACI,iBAAiB,CAAC,GAAW,EAAE,OAA6B;QACjE,yEAAyE;QACzE,wEAAwE;QACxE,4DAA4D;QAC5D,MAAM,UAAU,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IAChF,CAAC;CACF"}

package/dist/SQLScreeningScanner.d.ts

@@ -0,0 +1,91 @@
+/**
+ * @fileoverview Dialect-aware SQL scanner for MemberJunction's SQL denylist screens.
+ *
+ * A denylist screen is only as good as its idea of which text is code. This scanner reads SQL the
+ * way SQL Server or PostgreSQL splits it into tokens and marks every string literal, quoted
+ * identifier and comment, so a screen checks exactly the text the database runs as code. When it
+ * cannot read the text the way the database would, it reports that, so the screen rejects the text
+ * instead of guessing.
+ *
+ * Used by `SQLExpressionValidator` and `DatabaseProviderBase.ValidateUserProvidedSQLClause`.
+ *
+ * @module @memberjunction/global/SQLScreeningScanner
+ */
+/** SQL dialects whose lexical rules {@link ScanSQLForScreening} knows. */
+export type SQLScreeningDialect = 'sqlserver' | 'postgresql';
+/**
+ * Every dialect {@link ScanSQLForScreening} knows. A screen that does not know which database will
+ * run the SQL must accept it under each one.
+ */
+export declare const SQL_SCREENING_DIALECTS: readonly SQLScreeningDialect[];
+/** Kinds of text that the database never runs as code. */
+export type SQLScreeningSpanKind = 'string' | 'identifier' | 'comment';
+/** One string literal, quoted identifier or comment found by {@link ScanSQLForScreening}. */
+export interface SQLScreeningSpan {
+    Kind: SQLScreeningSpanKind;
+    /** Offset of the first character, including a prefix such as `N` or `E`. */
+    Start: number;
+    /** Offset just past the last character. */
+    End: number;
+}
+/** Result of {@link ScanSQLForScreening}. */
+export interface SQLScreeningScan {
+    /** The dialect whose rules were applied. */
+    Dialect: SQLScreeningDialect;
+    /** True when every character was read the way the database reads it. When false, reject the text. */
+    Classified: boolean;
+    /** Why the text could not be classified; null when {@link Classified} is true. */
+    Error: string | null;
+    /** The string literals, quoted identifiers and comments found, in order. */
+    Spans: SQLScreeningSpan[];
+    /** Number of comments found. */
+    CommentCount: number;
+    /**
+     * The input with each string literal, quoted identifier and comment replaced by one space, and a
+     * space between a number and a word written against it. Only code remains, split where the
+     * database splits it, so `N'x'UNION` reads as ` UNION` and `1UNION` as `1 UNION`. Keyword,
+     * statement-separator and comment-marker checks read this. When {@link Classified} is false,
+     * the text from the point where the scan stopped is left as written.
+     */
+    Code: string;
+    /**
+     * {@link Code}, except each quoted identifier is written as its bare name between spaces, so
+     * `[sys].[objects]` reads as ` sys . objects `. Checks for object and function names read this,
+     * so quoting a name does not hide it.
+     */
+    CodeWithIdentifiers: string;
+    /**
+     * The first token that is not whitespace or a comment, when that token is an unquoted word and
+     * the character after it is ASCII, so every server ends the word in the same place. Null when a
+     * literal, quoted identifier, number or symbol comes first, or there is no token. Checks for the
+     * statement's opening keyword read this.
+     */
+    LeadingWord: string | null;
+}
+/**
+ * Reads `sql` the way `dialect` splits it into tokens. Returns the string literals, quoted
+ * identifiers and comments it contains, and the code that remains.
+ *
+ * Both dialects: `'…'` and `N'…'` strings, in which `''` is an escaped quote and a backslash is an
+ * ordinary character; `"…"` identifiers with `""` escapes; `--` comments to the end of the line; and
+ * nested block comments. SQL Server adds `[…]` identifiers with `]]` escapes. PostgreSQL adds `E'…'`
+ * strings, in which a backslash escapes the next character, and dollar-quoted strings (`$$…$$`,
+ * `$tag$…$tag$`); a `[` is code there.
+ *
+ * 🚨 Do not add backslash escapes to plain `'…'` strings. Neither server honors them (PostgreSQL is
+ * assumed to run with `standard_conforming_strings = on`, its default since 9.1), and a scanner that
+ * does reads `x = 'a\') ; DROP TABLE t; --'` as one literal while the database runs the DROP.
+ *
+ * The scan stops and reports an error, instead of guessing, when:
+ * - a string, quoted identifier, dollar-quoted string or block comment is not closed;
+ * - the text contains a NUL character;
+ * - a `--` comment contains a line break other than `\n` or `\r\n`;
+ * - a PostgreSQL `E'…'` string is followed by another quoted segment, which PostgreSQL can join to
+ *   it and read with backslash escapes;
+ * - on SQL Server, a number is followed by `e` and a word character (`1EXEC` splits two ways).
+ *
+ * @param sql The clause, expression or query to read
+ * @param dialect The dialect whose lexical rules apply
+ */
+export declare function ScanSQLForScreening(sql: string, dialect: SQLScreeningDialect): SQLScreeningScan;
+//# sourceMappingURL=SQLScreeningScanner.d.ts.map