@memberjunction/server 6.1.4 → 6.1.5

package/dist/postgresqlPoolSettings.d.ts

@@ -0,0 +1,108 @@
+/**
+ * Connection settings for MJAPI's PostgreSQL pools, derived from the same `databaseSettings`
+ * values SQL Server reads, with the same defaults.
+ *
+ * | Setting                              | SQL Server                       | PostgreSQL                                   |
+ * |--------------------------------------|----------------------------------|----------------------------------------------|
+ * | `requestTimeout`                     | driver request timeout           | `statement_timeout` on every backend         |
+ * | `connectionPool.max` / `min`         | pool size                        | pool size                                    |
+ * | `connectionPool.idleTimeoutMillis`   | idle connection eviction         | idle connection eviction                     |
+ * | `connectionPool.acquireTimeoutMillis`| wait for a pooled connection     | `connectionTimeoutMillis` (see below)        |
+ * | `connectionTimeout`                  | time to open a connection        | not used                                     |
+ *
+ * Where the two cannot match exactly:
+ * - The `pg` pool has one timeout covering both waiting for a free slot and opening a connection.
+ *   It is fed from `acquireTimeoutMillis`; `connectionTimeout` is not used on PostgreSQL.
+ * - SQL Server's `requestTimeout` is a client-side timer over the whole request, including reading
+ *   rows. PostgreSQL's `statement_timeout` is server-side execution time per statement, so a query
+ *   that executes quickly and returns its rows slowly is not cut off on PostgreSQL.
+ * - `idle_in_transaction_session_timeout` has no SQL Server counterpart. It is derived as twice the
+ *   statement timeout, so a transaction left open by an abandoned request is ended and its locks
+ *   released.
+ * - MJAPI opens a raw compatibility pool and a provider pool, each up to `connectionPool.max`, plus
+ *   a CodeGen pool of 10 and, when a read-only login is configured, a read-only pool of at most 10,
+ *   where SQL Server opens one pool (and a read-only one). PostgreSQL's default `max_connections`
+ *   is 100, so the read-only and CodeGen pools are kept small.
+ */
+import type { PGConnectionConfig } from '@memberjunction/postgresql-dataprovider';
+import type { Pool, PoolConfig } from 'pg';
+import { BaseSingleton } from '@memberjunction/global';
+import type { DatabaseSettingsInfo } from './config.js';
+/** Statement timeout for the CodeGen/DDL pool, matching the SQL Server CodeGen pool. */
+export declare const CODEGEN_STATEMENT_TIMEOUT_MS = 600000;
+/**
+ * Which pool the settings are for: API traffic, the read-only pool for caller-supplied SQL, or
+ * CodeGen and DDL work.
+ */
+export type PostgreSQLPoolPurpose = 'api' | 'read-only' | 'codegen';
+/** Where a PostgreSQL pool connects and as whom. */
+export interface PostgreSQLEndpoint {
+    Host: string;
+    Port: number;
+    Database: string;
+    User: string;
+    Password: string;
+}
+/** Reads the PostgreSQL endpoint from `PG_*` environment variables, then `DB_*` ones. */
+export declare function ResolvePostgreSQLEndpoint(env?: NodeJS.ProcessEnv): PostgreSQLEndpoint;
+/** The idle-in-transaction limit for a given statement timeout; 0 means none. */
+export declare function IdleInTransactionTimeoutFor(statementTimeoutMs: number): number;
+/** Builds the provider connection config for one of MJAPI's PostgreSQL pools. */
+export declare function BuildPostgreSQLConnectionConfig(endpoint: PostgreSQLEndpoint, settings: DatabaseSettingsInfo, purpose: PostgreSQLPoolPurpose): PGConnectionConfig;
+/**
+ * Maps a provider connection config onto `pg.Pool` options, for the pools MJAPI creates directly
+ * rather than through the provider. Timeouts that are unset or 0 are left out.
+ */
+export declare function ToPGPoolConfig(config: PGConnectionConfig): PoolConfig;
+/** Credentials for a read-only database login. */
+export interface ReadOnlyCredentials {
+    User: string;
+    Password: string;
+}
+/**
+ * The read-only login for PostgreSQL: the `dbReadOnlyUsername` / `dbReadOnlyPassword` settings
+ * SQL Server uses (which default from `DB_READ_ONLY_USERNAME` / `DB_READ_ONLY_PASSWORD`), then
+ * `PG_READ_ONLY_USERNAME` / `PG_READ_ONLY_PASSWORD`. `null` when neither pair is complete.
+ */
+export declare function ResolvePostgreSQLReadOnlyCredentials(configured: {
+    dbReadOnlyUsername?: string;
+    dbReadOnlyPassword?: string;
+}, env?: NodeJS.ProcessEnv): ReadOnlyCredentials | null;
+/**
+ * Holds MJAPI's PostgreSQL read-only pool, opened once at startup with the read-only login.
+ * Per-request read-only providers share it, so they connect as the read-only user rather than
+ * through the read-write pool.
+ */
+export declare class PostgreSQLReadOnlyPool extends BaseSingleton<PostgreSQLReadOnlyPool> {
+    private _pool;
+    /** Use {@link PostgreSQLReadOnlyPool.Instance}. */
+    constructor();
+    static get Instance(): PostgreSQLReadOnlyPool;
+    /** The read-only pool, or `null` when no read-only login is configured. */
+    get Pool(): Pool | null;
+    set Pool(pool: Pool | null);
+}
+/** What {@link DescribeReadOnlyLoginOverreach} reads about the read-only login. */
+export interface ReadOnlyLoginGrants {
+    ReadsServerFiles: boolean;
+    ReadableBaseTables: number;
+}
+/** The one method {@link DescribeReadOnlyLoginOverreach} needs from a connection; a `pg` client has it. */
+export interface ReadOnlyLoginCheckClient {
+    query(sql: string, params: unknown[]): Promise<{
+        rows: ReadOnlyLoginGrants[];
+    }>;
+}
+/**
+ * What the PostgreSQL read-only login can do beyond reading entity base views, as warnings to log at
+ * startup. Ad-hoc SQL and `TestQuerySQL` run as this login, and SQL can reach data through functions
+ * that no check of its table references sees (`query_to_xml`, file readers), so the login's own
+ * grants are the only complete limit. It should hold `SELECT` on the entity base views and nothing
+ * else: not on the base tables, and not membership of `pg_read_server_files`. Empty when the login
+ * is that narrow.
+ *
+ * @param client - A connection opened as the read-only login.
+ * @param coreSchema - The MJ core schema, whose base tables the login should not read.
+ */
+export declare function DescribeReadOnlyLoginOverreach(client: ReadOnlyLoginCheckClient, coreSchema: string): Promise<string[]>;
+//# sourceMappingURL=postgresqlPoolSettings.d.ts.map

package/dist/postgresqlPoolSettings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgresqlPoolSettings.d.ts","sourceRoot":"","sources":["../src/postgresqlPoolSettings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAExD,wFAAwF;AACxF,eAAO,MAAM,4BAA4B,SAAS,CAAC;AAQnD;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG,KAAK,GAAG,WAAW,GAAG,SAAS,CAAC;AAEpE,oDAAoD;AACpD,MAAM,WAAW,kBAAkB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED,yFAAyF;AACzF,wBAAgB,yBAAyB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,kBAAkB,CAQlG;AAED,iFAAiF;AACjF,wBAAgB,2BAA2B,CAAC,kBAAkB,EAAE,MAAM,GAAG,MAAM,CAE9E;AAED,iFAAiF;AACjF,wBAAgB,+BAA+B,CAC3C,QAAQ,EAAE,kBAAkB,EAC5B,QAAQ,EAAE,oBAAoB,EAC9B,OAAO,EAAE,qBAAqB,GAC/B,kBAAkB,CAuBpB;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,kBAAkB,GAAG,UAAU,CAerE;AAED,kDAAkD;AAClD,MAAM,WAAW,mBAAmB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,oCAAoC,CAChD,UAAU,EAAE;IAAE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAAE,EACxE,GAAG,GAAE,MAAM,CAAC,UAAwB,GACrC,mBAAmB,GAAG,IAAI,CAQ5B;AAED;;;;GAIG;AACH,qBAAa,sBAAuB,SAAQ,aAAa,CAAC,sBAAsB,CAAC;IAC7E,OAAO,CAAC,KAAK,CAAqB;IAElC,mDAAmD;;IAKnD,WAAkB,QAAQ,IAAI,sBAAsB,CAEnD;IAED,2EAA2E;IAC3E,IAAW,IAAI,IAAI,IAAI,GAAG,IAAI,CAE7B;IAED,IAAW,IAAI,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,EAEhC;CACJ;AAED,mFAAmF;AACnF,MAAM,WAAW,mBAAmB;IAChC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,kBAAkB,EAAE,MAAM,CAAC;CAC9B;AAED,2GAA2G;AAC3G,MAAM,WAAW,wBAAwB;IACrC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,mBAAmB,EAAE,CAAA;KAAE,CAAC,CAAC;CACnF;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,8BAA8B,CAAC,MAAM,EAAE,wBAAwB,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAiB5H"}

package/dist/postgresqlPoolSettings.js

@@ -0,0 +1,134 @@
+import { BaseSingleton } from '@memberjunction/global';
+/** Statement timeout for the CodeGen/DDL pool, matching the SQL Server CodeGen pool. */
+export const CODEGEN_STATEMENT_TIMEOUT_MS = 600000;
+/** Pool size for the CodeGen/DDL pool. */
+const CODEGEN_MAX_CONNECTIONS = 10;
+/** Largest pool size for the read-only pool, which serves only caller-supplied SQL. */
+const READ_ONLY_MAX_CONNECTIONS = 10;
+/** Reads the PostgreSQL endpoint from `PG_*` environment variables, then `DB_*` ones. */
+export function ResolvePostgreSQLEndpoint(env = process.env) {
+    return {
+        Host: env.PG_HOST || env.DB_HOST || 'localhost',
+        Port: parseInt(env.PG_PORT || env.DB_PORT || '5432', 10),
+        Database: env.PG_DATABASE || env.DB_DATABASE || '',
+        User: env.PG_USERNAME || env.DB_USERNAME || 'postgres',
+        Password: env.PG_PASSWORD || env.DB_PASSWORD || ''
+    };
+}
+/** The idle-in-transaction limit for a given statement timeout; 0 means none. */
+export function IdleInTransactionTimeoutFor(statementTimeoutMs) {
+    return statementTimeoutMs > 0 ? statementTimeoutMs * 2 : 0;
+}
+/** Builds the provider connection config for one of MJAPI's PostgreSQL pools. */
+export function BuildPostgreSQLConnectionConfig(endpoint, settings, purpose) {
+    const pool = settings.connectionPool;
+    if (purpose === 'codegen') {
+        return {
+            ...endpoint,
+            MaxConnections: CODEGEN_MAX_CONNECTIONS,
+            StatementTimeoutMs: CODEGEN_STATEMENT_TIMEOUT_MS,
+            IdleInTransactionSessionTimeoutMs: 0
+        };
+    }
+    const statementTimeoutMs = Math.max(0, settings.requestTimeout);
+    const apiMax = pool?.max ?? 50;
+    const apiMin = pool?.min ?? 5;
+    const readOnly = purpose === 'read-only';
+    return {
+        ...endpoint,
+        MaxConnections: readOnly ? Math.min(READ_ONLY_MAX_CONNECTIONS, apiMax) : apiMax,
+        MinConnections: readOnly ? 0 : apiMin,
+        IdleTimeoutMillis: pool?.idleTimeoutMillis ?? 30000,
+        ConnectionTimeoutMillis: pool?.acquireTimeoutMillis ?? 30000,
+        StatementTimeoutMs: statementTimeoutMs,
+        IdleInTransactionSessionTimeoutMs: IdleInTransactionTimeoutFor(statementTimeoutMs)
+    };
+}
+/**
+ * Maps a provider connection config onto `pg.Pool` options, for the pools MJAPI creates directly
+ * rather than through the provider. Timeouts that are unset or 0 are left out.
+ */
+export function ToPGPoolConfig(config) {
+    const pool = {
+        host: config.Host,
+        port: config.Port,
+        database: config.Database,
+        user: config.User,
+        password: config.Password,
+        max: config.MaxConnections
+    };
+    if (config.MinConnections !== undefined)
+        pool.min = config.MinConnections;
+    if (config.IdleTimeoutMillis !== undefined)
+        pool.idleTimeoutMillis = config.IdleTimeoutMillis;
+    if (config.ConnectionTimeoutMillis !== undefined)
+        pool.connectionTimeoutMillis = config.ConnectionTimeoutMillis;
+    if (config.StatementTimeoutMs)
+        pool.statement_timeout = config.StatementTimeoutMs;
+    if (config.IdleInTransactionSessionTimeoutMs)
+        pool.idle_in_transaction_session_timeout = config.IdleInTransactionSessionTimeoutMs;
+    return pool;
+}
+/**
+ * The read-only login for PostgreSQL: the `dbReadOnlyUsername` / `dbReadOnlyPassword` settings
+ * SQL Server uses (which default from `DB_READ_ONLY_USERNAME` / `DB_READ_ONLY_PASSWORD`), then
+ * `PG_READ_ONLY_USERNAME` / `PG_READ_ONLY_PASSWORD`. `null` when neither pair is complete.
+ */
+export function ResolvePostgreSQLReadOnlyCredentials(configured, env = process.env) {
+    if (configured.dbReadOnlyUsername && configured.dbReadOnlyPassword) {
+        return { User: configured.dbReadOnlyUsername, Password: configured.dbReadOnlyPassword };
+    }
+    if (env.PG_READ_ONLY_USERNAME && env.PG_READ_ONLY_PASSWORD) {
+        return { User: env.PG_READ_ONLY_USERNAME, Password: env.PG_READ_ONLY_PASSWORD };
+    }
+    return null;
+}
+/**
+ * Holds MJAPI's PostgreSQL read-only pool, opened once at startup with the read-only login.
+ * Per-request read-only providers share it, so they connect as the read-only user rather than
+ * through the read-write pool.
+ */
+export class PostgreSQLReadOnlyPool extends BaseSingleton {
+    /** Use {@link PostgreSQLReadOnlyPool.Instance}. */
+    constructor() {
+        super();
+        this._pool = null;
+    }
+    static get Instance() {
+        return PostgreSQLReadOnlyPool.getInstance();
+    }
+    /** The read-only pool, or `null` when no read-only login is configured. */
+    get Pool() {
+        return this._pool;
+    }
+    set Pool(pool) {
+        this._pool = pool;
+    }
+}
+/**
+ * What the PostgreSQL read-only login can do beyond reading entity base views, as warnings to log at
+ * startup. Ad-hoc SQL and `TestQuerySQL` run as this login, and SQL can reach data through functions
+ * that no check of its table references sees (`query_to_xml`, file readers), so the login's own
+ * grants are the only complete limit. It should hold `SELECT` on the entity base views and nothing
+ * else: not on the base tables, and not membership of `pg_read_server_files`. Empty when the login
+ * is that narrow.
+ *
+ * @param client - A connection opened as the read-only login.
+ * @param coreSchema - The MJ core schema, whose base tables the login should not read.
+ */
+export async function DescribeReadOnlyLoginOverreach(client, coreSchema) {
+    const result = await client.query(`SELECT pg_has_role(current_user, 'pg_read_server_files', 'MEMBER') AS "ReadsServerFiles",
+                (SELECT count(*)::int FROM pg_catalog.pg_tables t
+                  WHERE t.schemaname = $1
+                    AND has_table_privilege(current_user, quote_ident(t.schemaname) || '.' || quote_ident(t.tablename), 'SELECT')) AS "ReadableBaseTables"`, [coreSchema]);
+    const row = result.rows[0];
+    const warnings = [];
+    if (row?.ReadableBaseTables > 0) {
+        warnings.push(`The PostgreSQL read-only login can read ${row.ReadableBaseTables} base table(s) in schema "${coreSchema}". Ad-hoc SQL and TestQuerySQL run as this login; grant it SELECT on the entity base views only.`);
+    }
+    if (row?.ReadsServerFiles) {
+        warnings.push('The PostgreSQL read-only login is a member of pg_read_server_files, so SQL run as it can read files on the database server. Revoke that membership.');
+    }
+    return warnings;
+}
+//# sourceMappingURL=postgresqlPoolSettings.js.map

package/dist/postgresqlPoolSettings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgresqlPoolSettings.js","sourceRoot":"","sources":["../src/postgresqlPoolSettings.ts"],"names":[],"mappings":"AA4BA,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAGvD,wFAAwF;AACxF,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC;AAEnD,0CAA0C;AAC1C,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAEnC,uFAAuF;AACvF,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAiBrC,yFAAyF;AACzF,MAAM,UAAU,yBAAyB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC1E,OAAO;QACH,IAAI,EAAE,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,IAAI,WAAW;QAC/C,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,IAAI,MAAM,EAAE,EAAE,CAAC;QACxD,QAAQ,EAAE,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,WAAW,IAAI,EAAE;QAClD,IAAI,EAAE,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,WAAW,IAAI,UAAU;QACtD,QAAQ,EAAE,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,WAAW,IAAI,EAAE;KACrD,CAAC;AACN,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,2BAA2B,CAAC,kBAA0B;IAClE,OAAO,kBAAkB,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,+BAA+B,CAC3C,QAA4B,EAC5B,QAA8B,EAC9B,OAA8B;IAE9B,MAAM,IAAI,GAAG,QAAQ,CAAC,cAAc,CAAC;IACrC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO;YACH,GAAG,QAAQ;YACX,cAAc,EAAE,uBAAuB;YACvC,kBAAkB,EAAE,4BAA4B;YAChD,iCAAiC,EAAE,CAAC;SACvC,CAAC;IACN,CAAC;IACD,MAAM,kBAAkB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAG,OAAO,KAAK,WAAW,CAAC;IACzC,OAAO;QACH,GAAG,QAAQ;QACX,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,yBAAyB,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM;QAC/E,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;QACrC,iBAAiB,EAAE,IAAI,EAAE,iBAAiB,IAAI,KAAK;QACnD,uBAAuB,EAAE,IAAI,EAAE,oBAAoB,IAAI,KAAK;QAC5D,kBAAkB,EAAE,kBAAkB;QACtC,iCAAiC,EAAE,2BAA2B,CAAC,kBAAkB,CAAC;KACrF,CAAC;AACN,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAA0B;IACrD,MAAM,IAAI,GAAe;QACrB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,GAAG,EAAE,MAAM,CAAC,cAAc;KAC7B,CAAC;IACF,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS;QAAE,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,cAAc,CAAC;IAC1E,IAAI,MAAM,CAAC,iBAAiB,KAAK,SAAS;QAAE,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,CAAC;IAC9F,IAAI,MAAM,CAAC,uBAAuB,KAAK,SAAS;QAAE,IAAI,CAAC,uBAAuB,GAAG,MAAM,CAAC,uBAAuB,CAAC;IAChH,IAAI,MAAM,CAAC,kBAAkB;QAAE,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,kBAAkB,CAAC;IAClF,IAAI,MAAM,CAAC,iCAAiC;QAAE,IAAI,CAAC,mCAAmC,GAAG,MAAM,CAAC,iCAAiC,CAAC;IAClI,OAAO,IAAI,CAAC;AAChB,CAAC;AAQD;;;;GAIG;AACH,MAAM,UAAU,oCAAoC,CAChD,UAAwE,EACxE,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,UAAU,CAAC,kBAAkB,IAAI,UAAU,CAAC,kBAAkB,EAAE,CAAC;QACjE,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,kBAAkB,EAAE,QAAQ,EAAE,UAAU,CAAC,kBAAkB,EAAE,CAAC;IAC5F,CAAC;IACD,IAAI,GAAG,CAAC,qBAAqB,IAAI,GAAG,CAAC,qBAAqB,EAAE,CAAC;QACzD,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,qBAAqB,EAAE,QAAQ,EAAE,GAAG,CAAC,qBAAqB,EAAE,CAAC;IACpF,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,sBAAuB,SAAQ,aAAqC;IAG7E,mDAAmD;IACnD;QACI,KAAK,EAAE,CAAC;QAJJ,UAAK,GAAgB,IAAI,CAAC;IAKlC,CAAC;IAEM,MAAM,KAAK,QAAQ;QACtB,OAAO,sBAAsB,CAAC,WAAW,EAA0B,CAAC;IACxE,CAAC;IAED,2EAA2E;IAC3E,IAAW,IAAI;QACX,OAAO,IAAI,CAAC,KAAK,CAAC;IACtB,CAAC;IAED,IAAW,IAAI,CAAC,IAAiB;QAC7B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACtB,CAAC;CACJ;AAaD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,MAAgC,EAAE,UAAkB;IACrG,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAC7B;;;2JAGmJ,EACnJ,CAAC,UAAU,CAAC,CACf,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,GAAG,EAAE,kBAAkB,GAAG,CAAC,EAAE,CAAC;QAC9B,QAAQ,CAAC,IAAI,CAAC,2CAA2C,GAAG,CAAC,kBAAkB,6BAA6B,UAAU,kGAAkG,CAAC,CAAC;IAC9N,CAAC;IACD,IAAI,GAAG,EAAE,gBAAgB,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,qJAAqJ,CAAC,CAAC;IACzK,CAAC;IACD,OAAO,QAAQ,CAAC;AACpB,CAAC"}

package/dist/resolvers/AdhocQueryResolver.d.ts

@@ -14,10 +14,15 @@ declare class AdhocQueryInput {
 /**
  * Resolver for executing ad-hoc (unsaved) SQL queries.
  *
+ * The query runs through the read-only provider's own ad-hoc path (`RunQuery` with `SQL`), the
+ * same one in-process callers use, so it behaves identically on every database platform: the SQL
+ * is validated and rendered there, paged in the database with a count, run under the caller's
+ * timeout, and on PostgreSQL inside a read-only transaction that is rolled back.
+ *
  * Security:
- * - SQL validated via SQLExpressionValidator (full_query context) — blocks mutations, dangerous operations
- * - Executes on read-only connection pool only (no fallback to read-write)
- * - Configurable timeout (default 30s)
+ * - SQL validated by the provider (SQLExpressionValidator, single read query) — blocks mutations
+ * - Read-only provider only (no fallback to read-write)
+ * - Configurable timeout (default 30s), enforced by the database
  * - Requires authenticated user (standard GraphQL auth, no @RequireSystemUser)
  * - Refuses scope-limited principals (see {@link IsScopeLimitedPrincipal}). Raw SQL bypasses
  *   RunView, entity permissions and row-level security, so the RLS scope tokens that confine a
@@ -28,23 +33,8 @@ declare class AdhocQueryInput {
  */
 export declare class AdhocQueryResolver extends ResolverBase {
     ExecuteAdhocQuery(input: AdhocQueryInput, context: AppContext): Promise<RunQueryResultType>;
-    /**
-     * Runs the page's data SQL, then — only when the page is FULL (so more rows may
-     * exist) — a COUNT(*) for the true total. A short (or unpaged) page needs no
-     * count: the exact total is `startRow + rowsReturned` (see {@link exactTotalFromPage}).
-     *
-     * The count is NON-FATAL: some queries page fine but cannot be counted — e.g.
-     * duplicate column names are legal in a result set but rejected inside the COUNT
-     * CTE wrap. A count failure must never sink the whole result, so we log it and
-     * report a lower-bound total (`startRow + rowsReturned`) and let the data render.
-     */
-    private executeDataAndCount;
-    /**
-     * Executes one SQL statement on the read-only pool, racing it against the shared
-     * wall-clock `deadline`. The timer is always cleared on completion so a settled
-     * query never leaves a dangling timeout armed.
-     */
-    private runSqlWithDeadline;
+    /** Maps the provider's result to the GraphQL shape, naming a timeout plainly. */
+    private toResultType;
     private buildErrorResult;
 }
 export {};

package/dist/resolvers/AdhocQueryResolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AdhocQueryResolver.d.ts","sourceRoot":"","sources":["../../src/resolvers/AdhocQueryResolver.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAIxD;;;GAGG;AACH,cACM,eAAe;IAEjB,GAAG,EAAE,MAAM,CAAC;IAGZ,cAAc,CAAC,EAAE,MAAM,CAAC;IAGxB,OAAO,CAAC,EAAE,MAAM,CAAC;IAGjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;;;GAcG;AACH,qBACa,kBAAmB,SAAQ,YAAY;IAE1C,iBAAiB,CACkB,KAAK,EAAE,eAAe,EACpD,OAAO,EAAE,UAAU,GAC3B,OAAO,CAAC,kBAAkB,CAAC;IAgI9B;;;;;;;;;OASG;YACW,mBAAmB;IA6BjC;;;;OAIG;YACW,kBAAkB;IAwBhC,OAAO,CAAC,gBAAgB;CAc3B"}
+{"version":3,"file":"AdhocQueryResolver.d.ts","sourceRoot":"","sources":["../../src/resolvers/AdhocQueryResolver.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAGxD;;;GAGG;AACH,cACM,eAAe;IAEjB,GAAG,EAAE,MAAM,CAAC;IAGZ,cAAc,CAAC,EAAE,MAAM,CAAC;IAGxB,OAAO,CAAC,EAAE,MAAM,CAAC;IAGjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBACa,kBAAmB,SAAQ,YAAY;IAE1C,iBAAiB,CACkB,KAAK,EAAE,eAAe,EACpD,OAAO,EAAE,UAAU,GAC3B,OAAO,CAAC,kBAAkB,CAAC;IAgC9B,iFAAiF;IACjF,OAAO,CAAC,YAAY;IA6BpB,OAAO,CAAC,gBAAgB;CAc3B"}

package/dist/resolvers/AdhocQueryResolver.js

@@ -12,14 +12,12 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 };
 import { Arg, Ctx, Query, Resolver, Field, Int, InputType } from 'type-graphql';
 import { LogError } from '@memberjunction/core';
-import { SQLExpressionValidator } from '@memberjunction/global';
-import { RenderPipeline } from '@memberjunction/generic-database-provider';
-import { GetReadOnlyDataSource, GetReadOnlyProvider } from '../util.js';
+import { configInfo } from '../config.js';
+import { GetReadOnlyProvider } from '../util.js';
 import { ResolverBase } from '../generic/ResolverBase.js';
 import { IsScopeLimitedPrincipal } from '../auth/scopeLimitedPrincipal.js';
 import { RunQueryResultType } from './QueryResolver.js';
-import { exactTotalFromPage, resolveAdhocTotalRowCount } from './adhoc-query-helpers.js';
-import sql from 'mssql';
+import { ClampAdhocTimeoutSeconds } from './adhocTimeout.js';
 /**
  * Input type for executing ad-hoc SQL queries directly.
  * The SQL is validated server-side to ensure it's a safe SELECT/WITH statement.
@@ -48,10 +46,15 @@ AdhocQueryInput = __decorate([
 /**
  * Resolver for executing ad-hoc (unsaved) SQL queries.
  *
+ * The query runs through the read-only provider's own ad-hoc path (`RunQuery` with `SQL`), the
+ * same one in-process callers use, so it behaves identically on every database platform: the SQL
+ * is validated and rendered there, paged in the database with a count, run under the caller's
+ * timeout, and on PostgreSQL inside a read-only transaction that is rolled back.
+ *
  * Security:
- * - SQL validated via SQLExpressionValidator (full_query context) — blocks mutations, dangerous operations
- * - Executes on read-only connection pool only (no fallback to read-write)
- * - Configurable timeout (default 30s)
+ * - SQL validated by the provider (SQLExpressionValidator, single read query) — blocks mutations
+ * - Read-only provider only (no fallback to read-write)
+ * - Configurable timeout (default 30s), enforced by the database
  * - Requires authenticated user (standard GraphQL auth, no @RequireSystemUser)
  * - Refuses scope-limited principals (see {@link IsScopeLimitedPrincipal}). Raw SQL bypasses
  *   RunView, entity permissions and row-level security, so the RLS scope tokens that confine a
@@ -63,180 +66,57 @@ AdhocQueryInput = __decorate([
 let AdhocQueryResolver = class AdhocQueryResolver extends ResolverBase {
     async ExecuteAdhocQuery(input, context) {
         const startTime = Date.now();
+        // SECURITY: refuse principals whose read authority is narrower than their role grant.
+        // Ad-hoc SQL does not go through RunView, entity permissions or row-level security, so the
+        // RLS scope tokens that confine a magic-link session are never substituted. There is no
+        // filter to narrow, so the only correct answer for such a principal is no.
+        if (IsScopeLimitedPrincipal(context.userPayload?.userRecord)) {
+            return this.buildErrorResult('Ad-hoc SQL execution is not permitted for scope-limited sessions.');
+        }
+        const provider = GetReadOnlyProvider(context.providers, { allowFallbackToReadWrite: false });
+        if (!provider) {
+            return this.buildErrorResult('No read-only data source available for ad-hoc query execution');
+        }
+        const contextUser = context.userPayload?.userRecord;
+        const timeoutSeconds = ClampAdhocTimeoutSeconds(input.TimeoutSeconds, configInfo.databaseSettings.requestTimeout);
+        // A negative offset must not reach paging, where it would turn paging off.
+        const startRow = Math.max(0, Number.isInteger(input.StartRow) ? input.StartRow : 0);
         try {
-            // 1. SECURITY: refuse principals whose read authority is narrower than their role
-            // grant. This resolver runs a raw SELECT on the read-only pool — it does NOT go
-            // through RunView, entity permissions or row-level security, so the RLS scope tokens
-            // that confine a magic-link session are never substituted here. There is no filter
-            // to narrow, so the only correct answer for such a principal is no. Checked before
-            // the SQL is even validated: authorization gates the work, it does not race it.
-            if (IsScopeLimitedPrincipal(context.userPayload?.userRecord)) {
-                return this.buildErrorResult('Ad-hoc SQL execution is not permitted for scope-limited sessions.');
-            }
-            // 2. Security: validate SQL using SQLExpressionValidator
-            const validator = SQLExpressionValidator.Instance;
-            const validation = validator.validateFullQuery(input.SQL);
-            if (!validation.valid) {
-                return this.buildErrorResult(validation.error || 'SQL validation failed');
-            }
-            // 3. Get READ-ONLY data source (no fallback to read-write)
-            let readOnlyDS;
-            try {
-                readOnlyDS = GetReadOnlyDataSource(context.dataSources, { allowFallbackToReadWrite: false });
-            }
-            catch {
-                return this.buildErrorResult('No read-only data source available for ad-hoc query execution');
-            }
-            // 4. Resolve platform from the read-only provider for the render pipeline.
-            let platform = 'sqlserver';
-            try {
-                const provider = GetReadOnlyProvider(context.providers, { allowFallbackToReadWrite: false });
-                if (provider?.PlatformKey)
-                    platform = provider.PlatformKey;
-            }
-            catch {
-                // Provider not configured — keep the default platform.
-            }
-            const contextUser = context.userPayload?.userRecord;
-            // 5. Route the SQL through RenderPipeline so composition tokens
-            // resolve, comments and templates are processed, and the row cap
-            // is applied at the database (via TOP / LIMIT / OFFSET-FETCH).
-            //
-            // Page whenever a positive MaxRows is requested — INCLUDING the first
-            // page (StartRow 0). This yields OFFSET/FETCH data SQL *and* a
-            // COUNT(*) query so the response reports the true total row count
-            // rather than just the returned page size. It mirrors the saved-query
-            // path (GenericDatabaseProvider.InternalRunQuery → WrapWithPaging).
-            // (Previously paging was gated on StartRow > 0, so page 1 fell back to
-            // a TOP-N cap with TotalRowCount = page size — hiding the pager.)
-            // Clamp StartRow to a non-negative integer. A negative offset must not slip
-            // past the paging gate (which would then run the query with no row cap at all).
-            const startRow = Math.max(0, Number.isInteger(input.StartRow) ? input.StartRow : 0);
-            const maxRows = input.MaxRows;
-            const usePaging = maxRows != null && Number.isInteger(maxRows) && maxRows > 0;
-            let dataSQL;
-            let countSQL = null;
-            try {
-                const rendered = RenderPipeline.Run(input.SQL, {
-                    Platform: platform,
-                    ContextUser: contextUser,
-                    ...(usePaging ? { Paging: { StartRow: startRow, MaxRows: maxRows } } : {}),
-                });
-                dataSQL = rendered.FinalSQL;
-                countSQL = rendered.PagingResult?.CountSQL ?? null;
-            }
-            catch (renderErr) {
-                const renderMsg = renderErr instanceof Error ? renderErr.message : String(renderErr);
-                return this.buildErrorResult(`Ad-hoc query rendering failed: ${renderMsg}`);
-            }
-            // 6. Execute the page (and, only when a full page needs it, the count) under
-            // a shared wall-clock deadline derived from the request's timeout budget.
-            const deadline = startTime + (input.TimeoutSeconds ?? 30) * 1000;
-            const { recordset, totalRowCount } = await this.executeDataAndCount(readOnlyDS, dataSQL, countSQL, startRow, usePaging ? maxRows : null, deadline);
-            const executionTimeMs = Date.now() - startTime;
-            // 7. Return as RunQueryResultType
-            return {
-                QueryID: '',
-                QueryName: 'Ad-Hoc Query',
-                Success: true,
-                Results: JSON.stringify(recordset),
-                RowCount: recordset.length,
-                TotalRowCount: totalRowCount,
-                PageNumber: usePaging ? Math.floor(startRow / maxRows) + 1 : undefined,
-                PageSize: usePaging ? maxRows : undefined,
-                ExecutionTime: executionTimeMs,
-                ErrorMessage: ''
-            };
+            const result = await provider.RunQuery({
+                SQL: input.SQL,
+                MaxRows: input.MaxRows,
+                StartRow: startRow,
+                TimeoutSeconds: timeoutSeconds,
+            }, contextUser);
+            return this.toResultType(result, startRow, input.MaxRows, timeoutSeconds, Date.now() - startTime);
         }
         catch (err) {
-            const executionTimeMs = Date.now() - startTime;
             const errorMessage = err instanceof Error ? err.message : String(err);
-            // Handle timeout
-            if (errorMessage.includes('timeout') || errorMessage.includes('Timeout')) {
-                return {
-                    QueryID: '',
-                    QueryName: 'Ad-Hoc Query',
-                    Success: false,
-                    Results: '[]',
-                    RowCount: 0,
-                    TotalRowCount: 0,
-                    PageNumber: undefined,
-                    PageSize: undefined,
-                    ExecutionTime: executionTimeMs,
-                    ErrorMessage: `Query execution exceeded ${input.TimeoutSeconds ?? 30} second timeout`
-                };
-            }
             LogError(`Ad-hoc query execution failed: ${errorMessage}`);
-            return {
-                QueryID: '',
-                QueryName: 'Ad-Hoc Query',
-                Success: false,
-                Results: '[]',
-                RowCount: 0,
-                TotalRowCount: 0,
-                PageNumber: undefined,
-                PageSize: undefined,
-                ExecutionTime: executionTimeMs,
-                ErrorMessage: `Query execution failed: ${errorMessage}`
-            };
-        }
-    }
-    /**
-     * Runs the page's data SQL, then — only when the page is FULL (so more rows may
-     * exist) — a COUNT(*) for the true total. A short (or unpaged) page needs no
-     * count: the exact total is `startRow + rowsReturned` (see {@link exactTotalFromPage}).
-     *
-     * The count is NON-FATAL: some queries page fine but cannot be counted — e.g.
-     * duplicate column names are legal in a result set but rejected inside the COUNT
-     * CTE wrap. A count failure must never sink the whole result, so we log it and
-     * report a lower-bound total (`startRow + rowsReturned`) and let the data render.
-     */
-    async executeDataAndCount(ds, dataSQL, countSQL, startRow, maxRows, deadline) {
-        const dataResult = await this.runSqlWithDeadline(ds, dataSQL, deadline);
-        const recordset = (dataResult.recordset ?? []);
-        // Total already known from the page alone (unpaged, or a short page)? Skip the count.
-        const exact = exactTotalFromPage(startRow, recordset.length, maxRows);
-        if (exact != null || !countSQL) {
-            return { recordset, totalRowCount: exact ?? recordset.length };
-        }
-        // Full page — a COUNT(*) is required to know the true total.
-        const lowerBound = startRow + recordset.length;
-        try {
-            const countResult = await this.runSqlWithDeadline(ds, countSQL, deadline);
-            return { recordset, totalRowCount: resolveAdhocTotalRowCount(countResult.recordset, lowerBound) };
-        }
-        catch (countErr) {
-            const msg = countErr instanceof Error ? countErr.message : String(countErr);
-            LogError(`Ad-hoc query row-count failed; reporting a lower-bound total (${lowerBound}). ${msg}`);
-            return { recordset, totalRowCount: lowerBound };
+            return this.buildErrorResult(`Query execution failed: ${errorMessage}`, Date.now() - startTime);
         }
     }
-    /**
-     * Executes one SQL statement on the read-only pool, racing it against the shared
-     * wall-clock `deadline`. The timer is always cleared on completion so a settled
-     * query never leaves a dangling timeout armed.
-     */
-    async runSqlWithDeadline(ds, sqlText, deadline) {
-        const remaining = deadline - Date.now();
-        if (remaining <= 0) {
-            throw new Error('Query timeout exceeded');
-        }
-        let timer;
-        try {
-            return await Promise.race([
-                new sql.Request(ds).query(sqlText),
-                new Promise((_, reject) => {
-                    timer = setTimeout(() => reject(new Error('Query timeout exceeded')), remaining);
-                }),
-            ]);
-        }
-        finally {
-            if (timer) {
-                clearTimeout(timer);
-            }
+    /** Maps the provider's result to the GraphQL shape, naming a timeout plainly. */
+    toResultType(result, startRow, maxRows, timeoutSeconds, executionTimeMs) {
+        if (!result.Success) {
+            const message = result.ErrorMessage ?? 'Ad-hoc query failed';
+            return this.buildErrorResult(/timeout/i.test(message) ? `Query execution exceeded ${timeoutSeconds} second timeout` : message, executionTimeMs);
         }
+        const paged = maxRows != null && Number.isInteger(maxRows) && maxRows > 0;
+        return {
+            QueryID: '',
+            QueryName: 'Ad-Hoc Query',
+            Success: true,
+            Results: JSON.stringify(result.Results),
+            RowCount: result.RowCount,
+            TotalRowCount: result.TotalRowCount,
+            PageNumber: paged ? Math.floor(startRow / maxRows) + 1 : undefined,
+            PageSize: paged ? maxRows : undefined,
+            ExecutionTime: executionTimeMs,
+            ErrorMessage: ''
+        };
     }
-    buildErrorResult(errorMessage) {
+    buildErrorResult(errorMessage, executionTimeMs = 0) {
         return {
             QueryID: '',
             QueryName: 'Ad-Hoc Query',
@@ -246,7 +126,7 @@ let AdhocQueryResolver = class AdhocQueryResolver extends ResolverBase {
             TotalRowCount: 0,
             PageNumber: undefined,
             PageSize: undefined,
-            ExecutionTime: 0,
+            ExecutionTime: executionTimeMs,
             ErrorMessage: errorMessage
         };
     }

package/dist/resolvers/AdhocQueryResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"AdhocQueryResolver.js","sourceRoot":"","sources":["../../src/resolvers/AdhocQueryResolver.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAoB,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAE3E,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACzF,OAAO,GAAG,MAAM,OAAO,CAAC;AAExB;;;GAGG;AAEH,IAAM,eAAe,GAArB,MAAM,eAAe;CAYpB,CAAA;AAVG;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,iEAAiE,EAAE,CAAC;;4CAC5F;AAGZ;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,2CAA2C,EAAE,CAAC;;uDACvE;AAGxB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,oFAAoF,EAAE,CAAC;;gDACvH;AAGjB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,qIAAqI,EAAE,CAAC;;iDACvK;AAXhB,eAAe;IADpB,SAAS,EAAE;GACN,eAAe,CAYpB;AAED;;;;;;;;;;;;;;GAcG;AAEI,IAAM,kBAAkB,GAAxB,MAAM,kBAAmB,SAAQ,YAAY;IAE1C,AAAN,KAAK,CAAC,iBAAiB,CACkB,KAAsB,EACpD,OAAmB;QAE1B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,IAAI,CAAC;YACD,kFAAkF;YAClF,gFAAgF;YAChF,qFAAqF;YACrF,mFAAmF;YACnF,mFAAmF;YACnF,gFAAgF;YAChF,IAAI,uBAAuB,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,CAAC;gBAC3D,OAAO,IAAI,CAAC,gBAAgB,CAAC,mEAAmE,CAAC,CAAC;YACtG,CAAC;YAED,yDAAyD;YACzD,MAAM,SAAS,GAAG,sBAAsB,CAAC,QAAQ,CAAC;YAClD,MAAM,UAAU,GAAG,SAAS,CAAC,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC1D,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,KAAK,IAAI,uBAAuB,CAAC,CAAC;YAC9E,CAAC;YAED,2DAA2D;YAC3D,IAAI,UAA8B,CAAC;YACnC,IAAI,CAAC;gBACD,UAAU,GAAG,qBAAqB,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC,CAAC;YACjG,CAAC;YAAC,MAAM,CAAC;gBACL,OAAO,IAAI,CAAC,gBAAgB,CAAC,+DAA+D,CAAC,CAAC;YAClG,CAAC;YAED,2EAA2E;YAC3E,IAAI,QAAQ,GAAqB,WAAW,CAAC;YAC7C,IAAI,CAAC;gBACD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC7F,IAAI,QAAQ,EAAE,WAAW;oBAAE,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC;YAC/D,CAAC;YAAC,MAAM,CAAC;gBACL,uDAAuD;YAC3D,CAAC;YACD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC;YAEpD,gEAAgE;YAChE,iEAAiE;YACjE,+DAA+D;YAC/D,EAAE;YACF,sEAAsE;YACtE,+DAA+D;YAC/D,kEAAkE;YAClE,sEAAsE;YACtE,oEAAoE;YACpE,uEAAuE;YACvE,kEAAkE;YAClE,4EAA4E;YAC5E,gFAAgF;YAChF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACrF,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;YAC9B,MAAM,SAAS,GAAG,OAAO,IAAI,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC;YAE9E,IAAI,OAAe,CAAC;YACpB,IAAI,QAAQ,GAAkB,IAAI,CAAC;YACnC,IAAI,CAAC;gBACD,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE;oBAC3C,QAAQ,EAAE,QAAQ;oBAClB,WAAW,EAAE,WAAW;oBACxB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC9E,CAAC,CAAC;gBACH,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC;gBAC5B,QAAQ,GAAG,QAAQ,CAAC,YAAY,EAAE,QAAQ,IAAI,IAAI,CAAC;YACvD,CAAC;YAAC,OAAO,SAAS,EAAE,CAAC;gBACjB,MAAM,SAAS,GAAG,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACrF,OAAO,IAAI,CAAC,gBAAgB,CAAC,kCAAkC,SAAS,EAAE,CAAC,CAAC;YAChF,CAAC;YAED,6EAA6E;YAC7E,0EAA0E;YAC1E,MAAM,QAAQ,GAAG,SAAS,GAAG,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;YACjE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAC/D,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,OAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CACjF,CAAC;YACF,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAE/C,kCAAkC;YAClC,OAAO;gBACH,OAAO,EAAE,EAAE;gBACX,SAAS,EAAE,cAAc;gBACzB,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;gBAClC,QAAQ,EAAE,SAAS,CAAC,MAAM;gBAC1B,aAAa,EAAE,aAAa;gBAC5B,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,OAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;gBACvE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,OAAQ,CAAC,CAAC,CAAC,SAAS;gBAC1C,aAAa,EAAE,eAAe;gBAC9B,YAAY,EAAE,EAAE;aACnB,CAAC;QACN,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAC/C,MAAM,YAAY,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAEtE,iBAAiB;YACjB,IAAI,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACvE,OAAO;oBACH,OAAO,EAAE,EAAE;oBACX,SAAS,EAAE,cAAc;oBACzB,OAAO,EAAE,KAAK;oBACd,OAAO,EAAE,IAAI;oBACb,QAAQ,EAAE,CAAC;oBACX,aAAa,EAAE,CAAC;oBAChB,UAAU,EAAE,SAAS;oBACrB,QAAQ,EAAE,SAAS;oBACnB,aAAa,EAAE,eAAe;oBAC9B,YAAY,EAAE,4BAA4B,KAAK,CAAC,cAAc,IAAI,EAAE,iBAAiB;iBACxF,CAAC;YACN,CAAC;YAED,QAAQ,CAAC,kCAAkC,YAAY,EAAE,CAAC,CAAC;YAC3D,OAAO;gBACH,OAAO,EAAE,EAAE;gBACX,SAAS,EAAE,cAAc;gBACzB,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,CAAC;gBACX,aAAa,EAAE,CAAC;gBAChB,UAAU,EAAE,SAAS;gBACrB,QAAQ,EAAE,SAAS;gBACnB,aAAa,EAAE,eAAe;gBAC9B,YAAY,EAAE,2BAA2B,YAAY,EAAE;aAC1D,CAAC;QACN,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,mBAAmB,CAC7B,EAAsB,EACtB,OAAe,EACf,QAAuB,EACvB,QAAgB,EAChB,OAAsB,EACtB,QAAgB;QAEhB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAA0B,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QACjG,MAAM,SAAS,GAAG,CAAC,UAAU,CAAC,SAAS,IAAI,EAAE,CAA8B,CAAC;QAE5E,sFAAsF;QACtF,MAAM,KAAK,GAAG,kBAAkB,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACtE,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC7B,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,KAAK,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;QACnE,CAAC;QAED,6DAA6D;QAC7D,MAAM,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC;QAC/C,IAAI,CAAC;YACD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAA4B,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACrG,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,yBAAyB,CAAC,WAAW,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,CAAC;QACtG,CAAC;QAAC,OAAO,QAAQ,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,QAAQ,YAAY,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC5E,QAAQ,CAAC,iEAAiE,UAAU,MAAM,GAAG,EAAE,CAAC,CAAC;YACjG,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC;QACpD,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,kBAAkB,CAC5B,EAAsB,EACtB,OAAe,EACf,QAAgB;QAEhB,MAAM,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACxC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,KAAgD,CAAC;QACrD,IAAI,CAAC;YACD,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;gBACtB,IAAI,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,KAAK,CAAI,OAAO,CAAC;gBACrC,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;oBAC7B,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;gBACrF,CAAC,CAAC;aACL,CAAC,CAAC;QACP,CAAC;gBAAS,CAAC;YACP,IAAI,KAAK,EAAE,CAAC;gBACR,YAAY,CAAC,KAAK,CAAC,CAAC;YACxB,CAAC;QACL,CAAC;IACL,CAAC;IAEO,gBAAgB,CAAC,YAAoB;QACzC,OAAO;YACH,OAAO,EAAE,EAAE;YACX,SAAS,EAAE,cAAc;YACzB,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,CAAC;YACX,aAAa,EAAE,CAAC;YAChB,UAAU,EAAE,SAAS;YACrB,QAAQ,EAAE,SAAS;YACnB,aAAa,EAAE,CAAC;YAChB,YAAY,EAAE,YAAY;SAC7B,CAAC;IACN,CAAC;CACJ,CAAA;AArNS;IADL,KAAK,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC;IAE3B,WAAA,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,CAAA;IACnC,WAAA,GAAG,EAAE,CAAA;;qCADsC,eAAe;;2DAgI9D;AAnIQ,kBAAkB;IAD9B,QAAQ,EAAE;GACE,kBAAkB,CAuN9B"}
+{"version":3,"file":"AdhocQueryResolver.js","sourceRoot":"","sources":["../../src/resolvers/AdhocQueryResolver.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAGhD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAE7D;;;GAGG;AAEH,IAAM,eAAe,GAArB,MAAM,eAAe;CAYpB,CAAA;AAVG;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,iEAAiE,EAAE,CAAC;;4CAC5F;AAGZ;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,2CAA2C,EAAE,CAAC;;uDACvE;AAGxB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,oFAAoF,EAAE,CAAC;;gDACvH;AAGjB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,qIAAqI,EAAE,CAAC;;iDACvK;AAXhB,eAAe;IADpB,SAAS,EAAE;GACN,eAAe,CAYpB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AAEI,IAAM,kBAAkB,GAAxB,MAAM,kBAAmB,SAAQ,YAAY;IAE1C,AAAN,KAAK,CAAC,iBAAiB,CACkB,KAAsB,EACpD,OAAmB;QAE1B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,sFAAsF;QACtF,2FAA2F;QAC3F,wFAAwF;QACxF,2EAA2E;QAC3E,IAAI,uBAAuB,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,CAAC;YAC3D,OAAO,IAAI,CAAC,gBAAgB,CAAC,mEAAmE,CAAC,CAAC;QACtG,CAAC;QACD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7F,IAAI,CAAC,QAAQ,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC,gBAAgB,CAAC,+DAA+D,CAAC,CAAC;QAClG,CAAC;QACD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC;QACpD,MAAM,cAAc,GAAG,wBAAwB,CAAC,KAAK,CAAC,cAAc,EAAE,UAAU,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QAClH,2EAA2E;QAC3E,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrF,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC;gBACnC,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,QAAQ,EAAE,QAAQ;gBAClB,cAAc,EAAE,cAAc;aACjC,EAAE,WAAW,CAAC,CAAC;YAChB,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC;QACtG,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,YAAY,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACtE,QAAQ,CAAC,kCAAkC,YAAY,EAAE,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC,gBAAgB,CAAC,2BAA2B,YAAY,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC;QACpG,CAAC;IACL,CAAC;IAED,iFAAiF;IACzE,YAAY,CAChB,MAAsB,EACtB,QAAgB,EAChB,OAA2B,EAC3B,cAAsB,EACtB,eAAuB;QAEvB,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,IAAI,qBAAqB,CAAC;YAC7D,OAAO,IAAI,CAAC,gBAAgB,CACxB,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,4BAA4B,cAAc,iBAAiB,CAAC,CAAC,CAAC,OAAO,EAChG,eAAe,CAClB,CAAC;QACN,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,IAAI,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC;QAC1E,OAAO;YACH,OAAO,EAAE,EAAE;YACX,SAAS,EAAE,cAAc;YACzB,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC;YACvC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,OAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;YACnE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;YACrC,aAAa,EAAE,eAAe;YAC9B,YAAY,EAAE,EAAE;SACnB,CAAC;IACN,CAAC;IAEO,gBAAgB,CAAC,YAAoB,EAAE,eAAe,GAAG,CAAC;QAC9D,OAAO;YACH,OAAO,EAAE,EAAE;YACX,SAAS,EAAE,cAAc;YACzB,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,CAAC;YACX,aAAa,EAAE,CAAC;YAChB,UAAU,EAAE,SAAS;YACrB,QAAQ,EAAE,SAAS;YACnB,aAAa,EAAE,eAAe;YAC9B,YAAY,EAAE,YAAY;SAC7B,CAAC;IACN,CAAC;CACJ,CAAA;AA/ES;IADL,KAAK,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC;IAE3B,WAAA,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,CAAA;IACnC,WAAA,GAAG,EAAE,CAAA;;qCADsC,eAAe;;2DAgC9D;AAnCQ,kBAAkB;IAD9B,QAAQ,EAAE;GACE,kBAAkB,CAiF9B"}