@mlagie/sql-connector 2.0.8 → 2.0.9
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +23 -7
- package/.github/ISSUE_TEMPLATE/bug_report.md +0 -43
- package/.github/ISSUE_TEMPLATE/feature_request.md +0 -29
- package/.github/workflows/publish.yml +0 -80
- package/eslint.config.mjs +0 -37
- package/releases/1.4.8.md +0 -43
- package/releases/1.5.0.md +0 -127
- package/releases/2.0.0.md +0 -32
- package/releases/2.0.1.md +0 -23
- package/releases/2.0.2.md +0 -20
- package/releases/2.0.3.md +0 -20
- package/releases/2.0.4.md +0 -42
- package/releases/2.0.5.md +0 -65
- package/releases/2.0.6.md +0 -80
- package/releases/2.0.7.md +0 -38
- package/releases/2.0.8.md +0 -5
- package/socket.yml +0 -4
- package/tests/Model.test.js +0 -721
- package/tests/ModelInstance.test.js +0 -335
- package/tests/buildQuery.test.js +0 -217
- package/tests/connect.test.js +0 -44
- package/tests/formatObject.test.js +0 -46
- package/tests/generateCondition.test.js +0 -241
- package/tests/mysqlMock.js +0 -22
- package/tests/safe.test.js +0 -48
- package/tests/sql.test.js +0 -62
- package/tests/sqlTypeMap.test.js +0 -16
package/package.json
CHANGED
|
@@ -1,13 +1,20 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@mlagie/sql-connector",
|
|
3
|
-
"version": "2.0.
|
|
3
|
+
"version": "2.0.9",
|
|
4
4
|
"description": "Le module sql-connector permet de gérer les connexions à une base de données MySQL, de définir des schémas de tables, et d'interagir avec les données de manière simple et efficace.",
|
|
5
5
|
"main": "index.js",
|
|
6
|
+
"files": [
|
|
7
|
+
"src",
|
|
8
|
+
"docs",
|
|
9
|
+
"index.d.ts",
|
|
10
|
+
"index.js"
|
|
11
|
+
],
|
|
6
12
|
"scripts": {
|
|
7
13
|
"test": "rm -r coverage ; node --experimental-vm-modules node_modules/jest/bin/jest.js --runInBand",
|
|
8
14
|
"test:publish": "npm publish --dry-run",
|
|
9
15
|
"test:watch": "node --experimental-vm-modules node_modules/jest/bin/jest.js --watch",
|
|
10
16
|
"test:coverage": "rm -r coverage ; node --experimental-vm-modules node_modules/jest/bin/jest.js --coverage",
|
|
17
|
+
"coverage:report": "node scripts/coverage-report.js",
|
|
11
18
|
"security": "npx eslint . --max-warnings 0 --ignore-pattern './tests/*'"
|
|
12
19
|
},
|
|
13
20
|
"repository": {
|
|
@@ -38,18 +45,27 @@
|
|
|
38
45
|
"license": "MIT",
|
|
39
46
|
"type": "commonjs",
|
|
40
47
|
"bugs": {
|
|
41
|
-
"url": "https://github.com/
|
|
48
|
+
"url": "https://github.com/mlagie/sql-connector/issues"
|
|
42
49
|
},
|
|
43
|
-
"homepage": "https://github.com/
|
|
50
|
+
"homepage": "https://github.com/mlagie/sql-connector#readme",
|
|
44
51
|
"private": false,
|
|
45
52
|
"dependencies": {
|
|
46
53
|
"@mlagie/logger": "1.0.2",
|
|
47
|
-
"mysql2": "3.
|
|
54
|
+
"mysql2": "3.23.1"
|
|
48
55
|
},
|
|
49
56
|
"devDependencies": {
|
|
50
57
|
"@eslint/js": "^10.0.1",
|
|
51
|
-
"eslint": "^10.
|
|
58
|
+
"eslint": "^10.8.0",
|
|
52
59
|
"eslint-plugin-security": "^4.0.1",
|
|
53
|
-
"jest": "
|
|
60
|
+
"jest": "30.4.2"
|
|
61
|
+
},
|
|
62
|
+
"overrides": {
|
|
63
|
+
"test-exclude": "^8.0.0",
|
|
64
|
+
"glob": "^13.0.6",
|
|
65
|
+
"minimatch": "^10.2.2",
|
|
66
|
+
"brace-expansion": "^5.0.9"
|
|
67
|
+
},
|
|
68
|
+
"allowScripts": {
|
|
69
|
+
"unrs-resolver@1.12.2": true
|
|
54
70
|
}
|
|
55
|
-
}
|
|
71
|
+
}
|
|
@@ -1,43 +0,0 @@
|
|
|
1
|
-
---
|
|
2
|
-
name: Bug report
|
|
3
|
-
about: Create a report to help us improve
|
|
4
|
-
title: ''
|
|
5
|
-
labels: ''
|
|
6
|
-
assignees: lagie-marin
|
|
7
|
-
|
|
8
|
-
---
|
|
9
|
-
|
|
10
|
-
## Bug Description
|
|
11
|
-
|
|
12
|
-
## Steps to Reproduce
|
|
13
|
-
|
|
14
|
-
1. Call the method `...`
|
|
15
|
-
2. Pass the following options/parameters `...`
|
|
16
|
-
3. Execute the code
|
|
17
|
-
4. See the error
|
|
18
|
-
|
|
19
|
-
## Code Snippet / Logs
|
|
20
|
-
|
|
21
|
-
**JavaScript Code:**
|
|
22
|
-
|
|
23
|
-
```javascript
|
|
24
|
-
// Insert the JavaScript code that triggers the issue here
|
|
25
|
-
const result = await MyModel.find({ ... });
|
|
26
|
-
```
|
|
27
|
-
|
|
28
|
-
## Error Logs / Output
|
|
29
|
-
|
|
30
|
-
```txt
|
|
31
|
-
TypeError: ... is not a function
|
|
32
|
-
at ...
|
|
33
|
-
```
|
|
34
|
-
|
|
35
|
-
## Expected Behavior
|
|
36
|
-
|
|
37
|
-
Example: The `find()` method should return a native JavaScript Array of `ModelInstance` objects so that `.length` or indexation like `[0]` works out of the box when multiple rows are returned.
|
|
38
|
-
|
|
39
|
-
## Environment
|
|
40
|
-
|
|
41
|
-
- sql-connector version: vX.X.X
|
|
42
|
-
- Node.js version: vXX.XX.X
|
|
43
|
-
- Database (MySQL/MariaDB...): MySQL vX.X
|
|
@@ -1,29 +0,0 @@
|
|
|
1
|
-
---
|
|
2
|
-
name: Feature request
|
|
3
|
-
about: Suggest an idea for this project
|
|
4
|
-
title: ''
|
|
5
|
-
labels: ''
|
|
6
|
-
assignees: lagie-marin
|
|
7
|
-
|
|
8
|
-
---
|
|
9
|
-
|
|
10
|
-
## Feature Type
|
|
11
|
-
- [ ] New method / API addition
|
|
12
|
-
- [ ] Performance improvement
|
|
13
|
-
- [ ] Architecture Refactoring (ORM / Data Mapping)
|
|
14
|
-
- [ ] Other:
|
|
15
|
-
|
|
16
|
-
## Problem Statement
|
|
17
|
-
*Example: Currently, the ORM wraps the raw driver payload `[rows, fields]` inside a single global `ModelInstance`. This forces developers to leak internal database structure by accessing nested arrays like `data[0][0]` when handling records, destroying proper encapsulation.*
|
|
18
|
-
|
|
19
|
-
## Proposed Solution
|
|
20
|
-
*Example: Refactor the `find()` method to map and split the query results. It should return a native Array where each row is mapped into its own independent `ModelInstance`. Implement dynamic data-mapping (via continuous references, Getters/Setters, or a Proxy) to allow direct property access (`job.status`) without cloning the memory footprint.*
|
|
21
|
-
|
|
22
|
-
## Desired Developer Experience (DX / Example)
|
|
23
|
-
```javascript
|
|
24
|
-
// Provide an example of how the ideal code should look after this feature:
|
|
25
|
-
const jobs = await InjectionJobs.find({ where: { status: "running" } });
|
|
26
|
-
|
|
27
|
-
console.log(jobs.length); // Native array length works
|
|
28
|
-
console.log(jobs[0].status); // Direct property access on the instance
|
|
29
|
-
await jobs[0].updateOne({ status: "success" }); // Instance methods remain fully bound
|
|
@@ -1,80 +0,0 @@
|
|
|
1
|
-
name: Publish Package
|
|
2
|
-
|
|
3
|
-
on:
|
|
4
|
-
workflow_dispatch:
|
|
5
|
-
release:
|
|
6
|
-
types: [published]
|
|
7
|
-
push:
|
|
8
|
-
branches:
|
|
9
|
-
- "**"
|
|
10
|
-
pull_request:
|
|
11
|
-
branches:
|
|
12
|
-
- main
|
|
13
|
-
jobs:
|
|
14
|
-
check_security:
|
|
15
|
-
runs-on: ubuntu-latest
|
|
16
|
-
steps:
|
|
17
|
-
- name: Checkout GH repository
|
|
18
|
-
uses: actions/checkout@v6
|
|
19
|
-
- name: setup node
|
|
20
|
-
uses: actions/setup-node@v6
|
|
21
|
-
with:
|
|
22
|
-
node-version: 22
|
|
23
|
-
- name: Install deps
|
|
24
|
-
run: npm ci
|
|
25
|
-
- name: Audit deps
|
|
26
|
-
continue-on-error: false
|
|
27
|
-
run: |
|
|
28
|
-
npm audit
|
|
29
|
-
- name: Check security of module
|
|
30
|
-
continue-on-error: false
|
|
31
|
-
run: |
|
|
32
|
-
npm run security
|
|
33
|
-
integrity:
|
|
34
|
-
runs-on: ubuntu-latest
|
|
35
|
-
steps:
|
|
36
|
-
- name: Checkout GH repository
|
|
37
|
-
uses: actions/checkout@v6
|
|
38
|
-
- name: setup node
|
|
39
|
-
uses: actions/setup-node@v6
|
|
40
|
-
with:
|
|
41
|
-
node-version: 22
|
|
42
|
-
- name: Install deps
|
|
43
|
-
run: npm ci
|
|
44
|
-
- name: Run integrity check
|
|
45
|
-
continue-on-error: false
|
|
46
|
-
run: |
|
|
47
|
-
npm run test
|
|
48
|
-
publish:
|
|
49
|
-
needs:
|
|
50
|
-
- check_security
|
|
51
|
-
- integrity
|
|
52
|
-
if: github.event_name == 'release' || github.event_name == 'workflow_dispatch'
|
|
53
|
-
runs-on: ubuntu-latest
|
|
54
|
-
environment: sqlc
|
|
55
|
-
permissions:
|
|
56
|
-
contents: read
|
|
57
|
-
id-token: write # Requis pour la provenance (--provenance)
|
|
58
|
-
|
|
59
|
-
steps:
|
|
60
|
-
# 1. Récupérer le code source
|
|
61
|
-
- name: Checkout du code
|
|
62
|
-
uses: actions/checkout@v6
|
|
63
|
-
|
|
64
|
-
# 2. Configurer Node.js pour registry.npmjs.org
|
|
65
|
-
- name: Configurer Node.js
|
|
66
|
-
uses: actions/setup-node@v6
|
|
67
|
-
with:
|
|
68
|
-
node-version: "22"
|
|
69
|
-
registry-url: "https://registry.npmjs.org/" # <-- Cible npmjs
|
|
70
|
-
scope: "@mlagie"
|
|
71
|
-
|
|
72
|
-
# 3. Installer les dépendances
|
|
73
|
-
- name: Installer les dépendances
|
|
74
|
-
run: npm ci
|
|
75
|
-
|
|
76
|
-
# 4. Publier sur le vrai registre npm
|
|
77
|
-
- name: Publier sur npmjs.com
|
|
78
|
-
run: npm publish --provenance --access public
|
|
79
|
-
env:
|
|
80
|
-
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
|
package/eslint.config.mjs
DELETED
|
@@ -1,37 +0,0 @@
|
|
|
1
|
-
import js from "@eslint/js";
|
|
2
|
-
import security from "eslint-plugin-security";
|
|
3
|
-
|
|
4
|
-
export default [
|
|
5
|
-
{
|
|
6
|
-
ignores: ["eslint.config.mjs"]
|
|
7
|
-
},
|
|
8
|
-
js.configs.recommended,
|
|
9
|
-
{
|
|
10
|
-
files: ["**/*.js"],
|
|
11
|
-
languageOptions: {
|
|
12
|
-
sourceType: "commonjs",
|
|
13
|
-
globals: {
|
|
14
|
-
console: "readonly",
|
|
15
|
-
exports: "readonly",
|
|
16
|
-
module: "readonly",
|
|
17
|
-
process: "readonly",
|
|
18
|
-
require: "readonly",
|
|
19
|
-
__dirname: "readonly",
|
|
20
|
-
__filename: "readonly"
|
|
21
|
-
}
|
|
22
|
-
},
|
|
23
|
-
plugins: {
|
|
24
|
-
security
|
|
25
|
-
},
|
|
26
|
-
rules: {
|
|
27
|
-
...security.configs.recommended.rules,
|
|
28
|
-
"no-unused-vars": [
|
|
29
|
-
"error",
|
|
30
|
-
{
|
|
31
|
-
argsIgnorePattern: "^(?:_|resolve|reject)$",
|
|
32
|
-
varsIgnorePattern: "^_$"
|
|
33
|
-
}
|
|
34
|
-
]
|
|
35
|
-
}
|
|
36
|
-
}
|
|
37
|
-
];
|
package/releases/1.4.8.md
DELETED
|
@@ -1,43 +0,0 @@
|
|
|
1
|
-
# **Release v1.4.8 — sql-connector**
|
|
2
|
-
|
|
3
|
-
## **Présentation**
|
|
4
|
-
Cette version poursuit la refonte de `sql-connector` avec une documentation plus lisible, une séparation claire entre les langues, et plusieurs améliorations de fiabilité sur les modèles et la génération SQL.
|
|
5
|
-
|
|
6
|
-
## **Nouveautés**
|
|
7
|
-
|
|
8
|
-
### Documentation bilingue
|
|
9
|
-
- La documentation a été restructurée pour séparer plus clairement le contenu en français et en anglais.
|
|
10
|
-
- Le README racine sert désormais de point d'entrée rapide vers la documentation.
|
|
11
|
-
- Le dossier `docs/` est utilisé pour regrouper les pages de documentation par langue.
|
|
12
|
-
|
|
13
|
-
### Synchronisation et schémas
|
|
14
|
-
- `Model.syncAllTables()` continue de comparer le schéma JS avec la base et applique les différences utiles de manière plus sûre.
|
|
15
|
-
- La longueur par défaut est désormais gérée correctement pour les types `VARCHAR` et `INT` quand `length` n'est pas défini.
|
|
16
|
-
- Une erreur explicite est levée si un champ est déclaré à la fois `primary_key` et `unique`.
|
|
17
|
-
|
|
18
|
-
### Modèles et requêtes
|
|
19
|
-
- `updateOne()` ignore automatiquement les champs `undefined`.
|
|
20
|
-
- Les mises à jour utilisent une condition `WHERE` plus robuste, en privilégiant les clés primaires quand elles sont disponibles.
|
|
21
|
-
- La génération des conditions SQL a été améliorée pour mieux normaliser les chaînes, les dates et les valeurs JSON.
|
|
22
|
-
|
|
23
|
-
### Dépendances et maintenance
|
|
24
|
-
- `glob` a été ajouté pour améliorer la détection des fichiers de backup SQL.
|
|
25
|
-
- Les logs de synchronisation et d'exécution ont été renforcés pour faciliter le débogage.
|
|
26
|
-
|
|
27
|
-
## **Migration depuis v1.4.5**
|
|
28
|
-
|
|
29
|
-
### Points principaux
|
|
30
|
-
1. La documentation a été réorganisée autour d'un accès plus simple par langue.
|
|
31
|
-
2. Les opérations de mise à jour de modèles sont maintenant plus fiables.
|
|
32
|
-
3. Les règles de génération SQL sont plus strictes et plus prévisibles.
|
|
33
|
-
|
|
34
|
-
### Recommandation
|
|
35
|
-
- Vérifiez vos schémas si vous utilisiez des champs sans `length`, des mises à jour avec des valeurs `undefined`, ou des colonnes déclarées à la fois `primary_key` et `unique`.
|
|
36
|
-
|
|
37
|
-
## **Documentation**
|
|
38
|
-
Pour plus de détails, consultez la documentation du projet dans `README.md` et le dossier `docs/`.
|
|
39
|
-
|
|
40
|
-
## **Liens utiles**
|
|
41
|
-
- [GitHub Repository](https://github.com/lagie-marin/sql-connector)
|
|
42
|
-
- [npm Package](https://www.npmjs.com/package/@mlagie/sql-connector)
|
|
43
|
-
- [Issues](https://github.com/lagie-marin/sql-connector/issues)
|
package/releases/1.5.0.md
DELETED
|
@@ -1,127 +0,0 @@
|
|
|
1
|
-
# **Release v1.5 — sql-connector**
|
|
2
|
-
|
|
3
|
-
## Overview
|
|
4
|
-
|
|
5
|
-
This release introduces a major improvement to the query system in sql-connector, focusing on flexibility, performance, and developer experience.
|
|
6
|
-
|
|
7
|
-
The new version simplifies query building, adds support for advanced SQL features (such as aggregation and date formatting), and improves consistency across model operations.
|
|
8
|
-
|
|
9
|
-
---
|
|
10
|
-
|
|
11
|
-
## New Features
|
|
12
|
-
|
|
13
|
-
### Enhanced Query Builder (findAll)
|
|
14
|
-
|
|
15
|
-
- findAll() now supports advanced SQL features through a clean and extensible configuration object.
|
|
16
|
-
- Developers can build complex queries without writing raw SQL.
|
|
17
|
-
|
|
18
|
-
Supported features:
|
|
19
|
-
|
|
20
|
-
- SUM, DATE_FORMAT, and custom field transformations
|
|
21
|
-
- GROUP BY, ORDER BY, HAVING, and LIMIT
|
|
22
|
-
- Multiple aggregations in a single query
|
|
23
|
-
|
|
24
|
-
Example:
|
|
25
|
-
|
|
26
|
-
```js
|
|
27
|
-
Model.findAll({
|
|
28
|
-
select: [
|
|
29
|
-
{ dateFormat: ['date_day', '%Y-%m'], as: 'period' },
|
|
30
|
-
{ sum: 'error' },
|
|
31
|
-
{ sum: 'reload' },
|
|
32
|
-
],
|
|
33
|
-
groupBy: ['period'],
|
|
34
|
-
orderBy: [{ field: 'period', direction: 'ASC' }]
|
|
35
|
-
});
|
|
36
|
-
```
|
|
37
|
-
|
|
38
|
-
---
|
|
39
|
-
|
|
40
|
-
### Dynamic Field Builder
|
|
41
|
-
|
|
42
|
-
- Query fields are now processed individually through a modular builder.
|
|
43
|
-
- Enables combining multiple transformations (e.g., multiple SUM, DATE_FORMAT) without hardcoding specific cases.
|
|
44
|
-
- Improves extensibility for future SQL functions (AVG, COUNT, etc.).
|
|
45
|
-
|
|
46
|
-
---
|
|
47
|
-
|
|
48
|
-
### Simplified Query Construction
|
|
49
|
-
|
|
50
|
-
- Query generation now follows a fixed SQL order (WHERE → GROUP BY → HAVING → ORDER BY → LIMIT) without unnecessary sorting.
|
|
51
|
-
- Improves performance and avoids overhead from dynamic reordering.
|
|
52
|
-
- Keeps the implementation simple and predictable.
|
|
53
|
-
|
|
54
|
-
---
|
|
55
|
-
|
|
56
|
-
### Improved Aggregation Support
|
|
57
|
-
|
|
58
|
-
- Designed for analytics use cases:
|
|
59
|
-
- Time-based grouping (day, month, year)
|
|
60
|
-
- Multi-metric aggregation
|
|
61
|
-
- Clean integration with frontend dashboards
|
|
62
|
-
|
|
63
|
-
---
|
|
64
|
-
|
|
65
|
-
### Better Developer Experience
|
|
66
|
-
|
|
67
|
-
- No need to write raw SQL for common queries
|
|
68
|
-
- Clear and readable query configuration
|
|
69
|
-
- Consistent API across simple and advanced queries
|
|
70
|
-
|
|
71
|
-
---
|
|
72
|
-
|
|
73
|
-
## Improvements
|
|
74
|
-
|
|
75
|
-
### customRequest function
|
|
76
|
-
|
|
77
|
-
- customRequest provides all the information instead of taking the first element of the request.
|
|
78
|
-
|
|
79
|
-
### Model Usage
|
|
80
|
-
|
|
81
|
-
- findAll() is now instance-based instead of static for better flexibility and dependency injection.
|
|
82
|
-
- Enables multiple database connections and improved testability.
|
|
83
|
-
|
|
84
|
-
---
|
|
85
|
-
|
|
86
|
-
### Performance Optimization
|
|
87
|
-
|
|
88
|
-
- Removed unnecessary iteration and sorting logic in query building.
|
|
89
|
-
- Query generation now runs in constant time structure (no scaling overhead with new features).
|
|
90
|
-
|
|
91
|
-
---
|
|
92
|
-
|
|
93
|
-
### Code Maintainability
|
|
94
|
-
|
|
95
|
-
- Cleaner separation between:
|
|
96
|
-
- field building
|
|
97
|
-
- query parts
|
|
98
|
-
- execution
|
|
99
|
-
|
|
100
|
-
- Easier to extend without modifying core logic.
|
|
101
|
-
|
|
102
|
-
## Migration from v1.4.x
|
|
103
|
-
|
|
104
|
-
### Main changes
|
|
105
|
-
|
|
106
|
-
1. Switch to instance-based model usage
|
|
107
|
-
2. Update findAll calls to use the new select format
|
|
108
|
-
3. Adapt queries using aggregation to the new field builder system
|
|
109
|
-
|
|
110
|
-
### Recommendation
|
|
111
|
-
|
|
112
|
-
- Replace raw SQL queries with the new findAll configuration when possible
|
|
113
|
-
- Review existing analytics queries to leverage built-in aggregation support
|
|
114
|
-
|
|
115
|
-
## Documentation
|
|
116
|
-
|
|
117
|
-
See the updated documentation in:
|
|
118
|
-
|
|
119
|
-
- [README.md](../README.md)
|
|
120
|
-
|
|
121
|
-
## Useful Links
|
|
122
|
-
|
|
123
|
-
- GitHub Repository: <https://github.com/lagie-marin/sql-connector>
|
|
124
|
-
|
|
125
|
-
- npm Package: <https://www.npmjs.com/package/@mlagie/sql-connector>
|
|
126
|
-
|
|
127
|
-
- Issues: <https://github.com/lagie-marin/sql-connector/issues>
|
package/releases/2.0.0.md
DELETED
|
@@ -1,32 +0,0 @@
|
|
|
1
|
-
# **Release v2.0.0 — Security Hardening & Prototype Pollution Prevention**
|
|
2
|
-
|
|
3
|
-
This release focuses heavily on `security improvements` across the ORM's core model management and data access layers. We have successfully mitigated potential security vulnerabilities regarding dynamic property access and file path operations, satisfying `eslint-plugin-security` analysis.
|
|
4
|
-
|
|
5
|
-
## **Key Changes & Security Fixes**
|
|
6
|
-
|
|
7
|
-
### **1. Prototype Pollution & Object Injection Prevention**
|
|
8
|
-
|
|
9
|
-
- **Problem**: Using dynamic bracket notations like obj[key] where key originates from user inputs or database schemas exposed the application to **Object Injection** and **Prototype Pollution** (allowing attackers to alter critical global properties via keys like `__proto__` or `constructor`).
|
|
10
|
-
|
|
11
|
-
- **Fix**: Introduced a centralized `safe.js` security utility leveraging `Reflect.get()` and `Reflect.set()` coupled with a strict property blacklist (`__proto__`, `constructor`, `prototype`).
|
|
12
|
-
- Migrated all dynamic model lookups and topological sorting dictionaries in `Model.js` to safe wrappers.
|
|
13
|
-
- Secured dynamic getters and setters mapped to data columns in `ModelInstance.js`.
|
|
14
|
-
|
|
15
|
-
### **2. Path Traversal & Safe Database Backups**
|
|
16
|
-
|
|
17
|
-
- **Problem**: Dynamically naming automated backup files (**.sql**) based on database table names without validation triggered `detect-non-literal-fs-filename` warnings, opening up potential `Path Traversal` vector concerns.
|
|
18
|
-
|
|
19
|
-
- **Fix**: Implemented string sanitization via regex (`/[^a-zA-Z0-9_]/g`) on table-driven variables prior to passing arguments to standard `fs` sync methods (`writeFileSync`, `readFileSync`, `unlinkSync`, `renameSync`).
|
|
20
|
-
- Fully resolved all local `fs` filename security alerts.
|
|
21
|
-
|
|
22
|
-
### **3. General Code Refactoring**
|
|
23
|
-
|
|
24
|
-
- Replaced native object literals `{}` with prototype-less structures `(Object.create(null))` for configuration mappings and dependency graph resolution arrays to prevent unexpected inheritance bugs.
|
|
25
|
-
|
|
26
|
-
## **Component Impact**
|
|
27
|
-
|
|
28
|
-
| File | Changes Made | Warning Cleared |
|
|
29
|
-
|-------------------------------|-------------------------------------------------------------------|-------------------------------------------------------------|
|
|
30
|
-
| `src/utils/security/safe.js` | Created utility with `Reflect` API + validation blacklist | None (Fully clean) |
|
|
31
|
-
| `src/models/Model.js` | Patched `syncAllTables`, topological sort, and `fs` operations | `detect-object-injection`, `detect-non-literal-fs-filename` |
|
|
32
|
-
| `src/models/ModelInstance.js` | Secured active schema columns maps inside constructor proxies | `detect-object-injection` |
|
package/releases/2.0.1.md
DELETED
|
@@ -1,23 +0,0 @@
|
|
|
1
|
-
# Release v2.0.1 — Hotfix: Application Launch Crash (Variable Reference Error)
|
|
2
|
-
|
|
3
|
-
This patch release resolves a critical regression introduced in `v2.0.0` that completely blocked applications from starting when using `@mlagie/sql-connector`.
|
|
4
|
-
|
|
5
|
-
## Problem
|
|
6
|
-
|
|
7
|
-
Upon initializing the package or starting the parent application, a runtime crash occurred due to an undefined or incorrectly scoped variable. This prevented the ORM from establishing connections and loading models properly, causing the host application to crash immediately on boot.
|
|
8
|
-
|
|
9
|
-
## What Was Fixed
|
|
10
|
-
|
|
11
|
-
* **Variable Scope Resolution:** Fixed the broken variable reference causing the startup crash during initialization.
|
|
12
|
-
* **Boot Reliability:** Restored seamless application launches when importing and configuring the SQL connector.
|
|
13
|
-
|
|
14
|
-
---
|
|
15
|
-
|
|
16
|
-
## 📦 Component Impact
|
|
17
|
-
|
|
18
|
-
| Impacted Area | Description | Status |
|
|
19
|
-
| :--- | :--- | :--- |
|
|
20
|
-
| **Core Initialization** | Uncaught reference/variable error blocking `npm start` | **Fixed** |
|
|
21
|
-
| **Stability** | Application crash on package import | **Resolved** |
|
|
22
|
-
|
|
23
|
-
*If you encountered initialization errors with v2.0.0, please upgrade your dependency to v2.0.1 immediately.* `npm update @mlagie/sql-connector`
|
package/releases/2.0.2.md
DELETED
|
@@ -1,20 +0,0 @@
|
|
|
1
|
-
# Release v2.0.2 — Performance Optimization & Code Cleanup
|
|
2
|
-
|
|
3
|
-
This patch release focuses on optimizing the internal runtime footprint and improving overall execution performance by removing legacy, unused code paths and dependencies.
|
|
4
|
-
|
|
5
|
-
## What Was Improved
|
|
6
|
-
|
|
7
|
-
* **Dead Code Elimination:** Removed unused functions, legacy variables, and obsolete logic that were lingering from previous architecture overhauls (such as the old `serveur` logger reference).
|
|
8
|
-
* **Performance Boost:** Cleaning up these elements reduces CPU overhead and memory usage during runtime model instantiation and schema synchronization.
|
|
9
|
-
* **Code Maintenance:** Streamlined internal loops and conditional structures to ensure the ORM remains fast, lightweight, and maintainable.
|
|
10
|
-
|
|
11
|
-
---
|
|
12
|
-
|
|
13
|
-
## Component Impact
|
|
14
|
-
|
|
15
|
-
| Impacted Area | Description | Status |
|
|
16
|
-
| :--- | :--- | :--- |
|
|
17
|
-
| **ModelInstance & Models** | Removal of unused references and obsolete properties | **Optimized** |
|
|
18
|
-
| **Runtime Footprint** | Decreased execution overhead during database mappings | **Improved** |
|
|
19
|
-
|
|
20
|
-
*This is a fully backward-compatible patch. Upgrading is highly recommended to benefit from the performance improvements.* `npm update @mlagie/sql-connector`
|
package/releases/2.0.3.md
DELETED
|
@@ -1,20 +0,0 @@
|
|
|
1
|
-
# 🛡️ Release v2.0.3 — Security Overhaul: Prepared Statements (`.execute`)
|
|
2
|
-
|
|
3
|
-
This major patch introduces a complete migration from raw `.query()` to parameterized Prepared Statements (`.execute()`) for all data-driven database operations, offering definitive protection against SQL Injection.
|
|
4
|
-
|
|
5
|
-
## What Was Improved
|
|
6
|
-
|
|
7
|
-
* **Prepared Statements Migration:** Replaced `.query()` with `.execute()` in critical data-handling pipelines (`save`, `generate_uuid`, `updateOne`, `deleteOne`).
|
|
8
|
-
* **Native Value Escaping:** Transitioned from manual string manipulation/escaping functions to the database driver's native binary protocol placeholder mechanism (`?`).
|
|
9
|
-
* **Bulletproof Security:** User inputs are now strictly bound as parameters, ensuring they are never interpreted as executable SQL commands by the database server.
|
|
10
|
-
|
|
11
|
-
---
|
|
12
|
-
|
|
13
|
-
## Component Impact
|
|
14
|
-
|
|
15
|
-
| Impacted Area | Description | Status |
|
|
16
|
-
| :--- | :--- | :--- |
|
|
17
|
-
| **Model.js** | Upgraded `save` and `generate_uuid` to use native placeholder bindings | **Secured** |
|
|
18
|
-
| **ModelInstance.js** | Rewritten `updateOne`, `delete`, and `deleteOne` to prevent unsafe raw query concatenation | **Secured** |
|
|
19
|
-
|
|
20
|
-
*Upgrading is highly recommended for all environments handling user-supplied data.* `npm update @mlagie/sql-connector`
|
package/releases/2.0.4.md
DELETED
|
@@ -1,42 +0,0 @@
|
|
|
1
|
-
# Release v2.0.4 — SQL Safety Hardening, CI/CD Pipeline & 100% Unit Test Coverage
|
|
2
|
-
|
|
3
|
-
This release focuses on total SQL security enforcement across the ORM core, introducing a fully sandboxed unit testing suite, automated pipeline hooks, and eliminating raw string injection vectors.
|
|
4
|
-
|
|
5
|
-
## Breaking Security Change (Important)
|
|
6
|
-
|
|
7
|
-
- **Raw WHERE Strings Deprecated**: To ensure absolute resistance against SQL Injections, passing raw strings directly to the `where` clause (e.g., `{ where: "WHERE id = 1" }`) **is no longer allowed**. The engine now enforces structured object configurations (e.g., `{ where: { id: 1 } }`), forcing all column keys through `escapeIdentifier()` and all arguments through parameter serialization.
|
|
8
|
-
|
|
9
|
-
## What Was Improved
|
|
10
|
-
|
|
11
|
-
- **Stricter SQL Identifier Handling**: Centralized identifier escaping and splitting inside `utils/sql.js` now natively supports qualified names (such as `MyTable.myrow`) and pre-backticked configurations, eliminating redundant wrapping.
|
|
12
|
-
|
|
13
|
-
- **100% Core Test Coverage**: Implemented a global testing architecture at the project root using Jest with **--experimental-vm-modules** to support dynamic logging imports. 100% of internal utilities (`safe.js`, `sql.js`, `formatObject.js`, `generateCondition.js`, `buildQuery.js`) are now under continuous validation.
|
|
14
|
-
|
|
15
|
-
- **Isolated MySQL Mock Engine**: Created an offline test harness (`tests/mysqlMock.js`) using `jest.requireActual` to keep core string-escaping utilities intact while safely mocking pools, connections, and deep multi-dimensional database responses.
|
|
16
|
-
|
|
17
|
-
- **Group By Expression Support**: Improved `GROUP BY` handling to natively parse and wrap SQL expressions such as `DATE_FORMAT(...)` without throwing strict validation failures.
|
|
18
|
-
|
|
19
|
-
- **Fail-Safe CI/CD Automation**: Updated GitHub Actions (`publish.yml`) to automatically spawn `push`, `pull_request`, and `release` hooks. The NPM deployment workflow will now `instantly abort/skip` if a single security audit or unit test fails.
|
|
20
|
-
|
|
21
|
-
## Component Impact
|
|
22
|
-
|
|
23
|
-
| Impacted Area | Description | Status |
|
|
24
|
-
|----------------------------|----------------------------------------------------------------------------------------------------------------------------|------------------|
|
|
25
|
-
| Model.js / ModelInstance.js| Aligned generate_uuid() array de-structuring and secured query execution workflows against unhandled runtime crashes. | Hardened & Fixed |
|
|
26
|
-
| buildQuery.js / sql.js | Intercepts raw strings to reject unauthorized keywords while allowing safe, isolated expression formatters. | Secured |
|
|
27
|
-
| tests/ (New) | Centralized testing suite at the workspace root containing independent .test.js files for edge-case and injection testing. | Covered |
|
|
28
|
-
| .github/workflows/ | Refactored publish.yml with continuous integrity verification gates ahead of release targets. | Automated |
|
|
29
|
-
|
|
30
|
-
## Quick Test Verification
|
|
31
|
-
|
|
32
|
-
To execute the newly integrated unit testing harness locally before deployment, run:
|
|
33
|
-
|
|
34
|
-
```sh
|
|
35
|
-
# Execute the entire suite sequentially
|
|
36
|
-
npm run test
|
|
37
|
-
|
|
38
|
-
# Target a specific module in watch-mode (Developer Experience)
|
|
39
|
-
npm test -- --watch --onlyFailures
|
|
40
|
-
```
|
|
41
|
-
|
|
42
|
-
*This patch significantly locks down database interfaces and ensures zero regression on core utility calculations. Run npm update @mlagie/sql-connector to fetch the latest changes*
|
package/releases/2.0.5.md
DELETED
|
@@ -1,65 +0,0 @@
|
|
|
1
|
-
# Release v2.0.5 — Aggregation Engine Expansion (COUNT, DISTINCT & Group Matrix Resolution)
|
|
2
|
-
|
|
3
|
-
This release expands the dynamic query builder capability to support structured multi-row statistical analysis (`COUNT` and `DISTINCT`) while maintaining full architectural alignment with our strict SQL Safety parameters.
|
|
4
|
-
|
|
5
|
-
## What Was Improved
|
|
6
|
-
|
|
7
|
-
- **Native Secure** `COUNT` `Aggregation Matrix`: Introduced the structured `{ count: "*" }` or `{ count: "column_name" }` block into `utils/buildQuery.js`. This allows developers to safely generate standard SQL COUNT() aggregations without raw string shortcuts triggering safety breaches in escapeIdentifier().
|
|
8
|
-
|
|
9
|
-
- **Distinct Value Interception Support**: Optimized fields evaluation layout to support `DISTINCT` processing inside column mappings and `GROUP BY` structural nodes, resolving compatibility limits under aggressive `ONLY_FULL_GROUP_BY` database runtime settings.
|
|
10
|
-
|
|
11
|
-
- `Granular Regression Controls`: Hardened testing architecture with direct atomic assertions on nested selection objects to ensure utility stability over complex ingestion flows.
|
|
12
|
-
|
|
13
|
-
## **Unit Test Additions** (`tests/buildQuery.test.js`)
|
|
14
|
-
|
|
15
|
-
To ensure functional continuity, the selection building block test matrix has been expanded with the following scenarios:
|
|
16
|
-
|
|
17
|
-
```js
|
|
18
|
-
describe('buildQuery - Advanced Fields & Aggregations', () => {
|
|
19
|
-
|
|
20
|
-
test('Should safely compile COUNT(*) aggregated calculations with an expression alias', () => {
|
|
21
|
-
const fields = [{ count: '*', as: 'total_user' }];
|
|
22
|
-
expect(buildSelect(fields)).toBe('COUNT(*) AS `total_user`');
|
|
23
|
-
});
|
|
24
|
-
|
|
25
|
-
test('Should safely compile COUNT(column) on structured column identifiers', () => {
|
|
26
|
-
const fields = [{ count: 'id', as: 'unique_ids' }];
|
|
27
|
-
expect(buildSelect(fields)).toBe('COUNT(`id`) AS `unique_ids`');
|
|
28
|
-
});
|
|
29
|
-
|
|
30
|
-
test('Should correctly process multi-column GROUP BY arrays to avoid ONLY_FULL_GROUP_BY validation issues', () => {
|
|
31
|
-
const options = {
|
|
32
|
-
select: ['status', 'email', { count: '*', as: 'total_user' }],
|
|
33
|
-
groupBy: ['status', 'email']
|
|
34
|
-
};
|
|
35
|
-
const parts = buildQueryParts(options);
|
|
36
|
-
|
|
37
|
-
expect(parts).toContain('GROUP BY `status`, `email`');
|
|
38
|
-
});
|
|
39
|
-
});
|
|
40
|
-
```
|
|
41
|
-
|
|
42
|
-
## Component Impact
|
|
43
|
-
|
|
44
|
-
| Impacted Area | Description | Status |
|
|
45
|
-
|------------------------------|-------------------------------------------------------------------------------------------------------------------------|--------------|
|
|
46
|
-
| **buildQuery.js** | Added `field.count` mapping to isolate raw expressions (`*`) safely from structural identifiers formatting. | **Upgraded** |
|
|
47
|
-
| **tests/buildQuery.test.js** | Integrated targeted coverage checking for isolated function behaviors and multi-field groups. | **Covered** |
|
|
48
|
-
| **Data Ingestion Modules** | Safely resolving analytical aggregations (like cross-team platform data pipeline counters) in single-trip transactions. | **Resolved** |
|
|
49
|
-
|
|
50
|
-
## Usage Example (Analytics Ingestion)
|
|
51
|
-
|
|
52
|
-
Instead of passing unstable raw operations, leverage the new token syntax in your models:
|
|
53
|
-
|
|
54
|
-
```js
|
|
55
|
-
const teamNameData = await ProjectPipeline.find({
|
|
56
|
-
select: [
|
|
57
|
-
"team",
|
|
58
|
-
"source",
|
|
59
|
-
{ count: "*", as: "total_pipelines" } // Raw counting handled securely
|
|
60
|
-
],
|
|
61
|
-
groupBy: ["team", "source"] // Aligned with database safety policies
|
|
62
|
-
});
|
|
63
|
-
```
|
|
64
|
-
|
|
65
|
-
*This release is fully covered by our automated CI/CD pipeline verification gates. Run npm update `@mlagie/sql-connector` to align your staging environments.*
|