@mlagie/sql-connector 2.1.3 → 2.2.0

package/README.md

@@ -3,7 +3,7 @@
 ![GitHub package.json version](https://img.shields.io/github/package-json/v/lagie-marin/sql-connector?color=#008000) ![NPM Downloads](https://img.shields.io/npm/d18m/%40mlagie%2Fsql-connector?color=#008000) ![NPM Downloads](https://img.shields.io/npm/dw/%40mlagie%2Fsql-connector?color=#008000) ![GitHub followers](https://img.shields.io/github/followers/lagie-marin?style=plastic&color=color%3D%23008000) ![GitHub repo size](https://img.shields.io/github/repo-size/lagie-marin/sql-connector?color=%green)
  ![GitHub last commit](https://img.shields.io/github/last-commit/lagie-marin/sql-connector)
 
-[Français](./docs/fr/README.md) | English
+[Français](./docs/fr/README_FR.md) | English
 
 sql-connector helps manage MySQL connections, define table schemas, sync tables automatically, and work with database models through a small API.
 
@@ -186,7 +186,7 @@ Retrieves entries from the table.
 - **Parameters** `options` *(Object)* - Query options.
 - **Parameters** `options.select` *(Array<string|SelectAggregation>)* - Fields, aggregations, or transformations to be returned.
 - **Parameters** `options.where` *(Object / string)* - Filtering conditions (key/value object or raw string condition).
-- **Parameters** `options.groupBy` *(string[])* - Fields used to group results.
+- **Parameters** `options.groupBy` *(Array<string|GroupAggregation>)* - Fields, columns, or expressions used to group results.
 - **Parameters** `options.orderBy` *(Array<string|OrderByOption>)* - Sorting rules.
 - **Parameters** `options.join` *(JoinOption / JoinOption[])* - Table join configuration structures.
 - **Parameters** `options.limit` *(number)* - Maximum number of results to return.
@@ -207,6 +207,16 @@ Each element in the `select` array can be either a standard string (raw column n
 | `count` (Object)                | `Object`          | Automated conditional aggregation (`CASE WHEN`). Perfect for KPIs and status metrics.                | `{ count: { deletedAt: null } }` $\rightarrow$ `COUNT(CASE WHEN` \`deletedAt\``= NULL THEN 1 END)` |
 | `as`                            | `string`          | Sets a custom output identifier or aggregation alias (SQL `AS`).                                     | `{ count: 'id', as: 'total' }` $\rightarrow$ `COUNT(` \`id\``) AS` \`total\`                       |
 
+### Advanced `groupBy` Options (`GroupAggregation`)
+
+The `groupBy` option accepts an array that can mix standard strings (raw column names) and advanced configuration objects for secure and parameterized grouping:
+
+|    object    | Type               | Description                                                                                       | Example / Generated SQL                                                        |
+|--------------|--------------------|---------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------|
+| `col`        | `string`           | Safely targets an unaggregated table column using structural object isolation.                    | { col: 'role' } -> `role`                                                      |
+| `dateFormat` | `[string, string]` | Securely groups by a formatted Date column using parameterized inputs (Format: [column, format]). | { dateFormat: ['created_at', '%Y-%m'] } -> DATE_FORMAT( `created_at`, '%Y-%m') |
+| `as`         | `string`           | Targets the specified select alias directly to comply with strict MySQL group structures.         | `{ col: 'role', as: 'user_role' }` ->\`user_role\`                             |
+
 ---
 
 ### Complex Structured Options (`orderBy` & `join`)
@@ -240,7 +250,7 @@ User.find({
     { sum: 'error' },
     { sum: 'reload' },
   ],
-  groupBy: ['period'],
+  groupBy: ['period', { dateFormat: ['date_day', '%Y-%m'] }],
   orderBy: [{ field: 'period', direction: 'ASC' }],
   limit: 10
 });
@@ -296,7 +306,7 @@ const ppiStats = await MyTable.find({
 });
 ```
 
-#### 3. Table Joins, Time Series Grouping, and Multi-Column Sorting
+#### 3. Table Joins, Mixed-Type Time Series Grouping, and Multi-Column Sorting
 
 An advanced query orchestration combining left table joining, date formatting conversions, and sorting:
 
@@ -309,13 +319,18 @@ const history = await MyTable.find({
     { dateFormat: ['ProjectPipelines.created_at', '%Y-%m'], as: 'period' },
     { count: 'ProjectPipelines.id', as: 'pipelines_count' }
   ],
-  where: "ProjectPipelines.deletedAt IS NULL", // Raw condition strings are permitted
+  where: {
+    status: 'ACTIVE'
+  },
   join: {
     table: 'Projects',
     on: 'ProjectPipelines.project_id = Projects.id',
     type: 'LEFT'
   },
-  groupBy: ['project_name', 'period'],
+  groupBy: [
+    'project_name',
+    { dateFormat: ['ProjectPipelines.created_at', '%Y-%m'] }
+  ],
   orderBy: [
     { field: 'period', direction: 'DESC' },
     { field: 'project_name', direction: 'ASC' }
@@ -414,7 +429,7 @@ const User = require("user");
 const uuid = await User.generate_uuid();
 const my_uuid = await User.generate_uuid("my_uuid");
 
-await User.save{ email: "user@example.com", status: "active", uuid: uuid, my_uuid: my_uuid }
+await User.save({ email: "user@example.com", status: "active", uuid: uuid, my_uuid: my_uuid })
 ```
 
 ## Model instances

package/docs/fr/{README.md → README_FR.md}

@@ -156,7 +156,7 @@ Récupère des enregistrements de la table.
 - **Paramètres** `options` *(Object)* – Options de la requête.
 - **Paramètres** `options.select` *(Array<string|SelectAggregation>)* – Champs, agrégations ou transformations à retourner.
 - **Paramètres** `options.where` *(Object / string)* – Conditions de filtrage (objet clé/valeur ou clause brute sous forme de chaîne).
-- **Paramètres** `options.groupBy` *(string[])* – Champs utilisés pour grouper les résultats.
+- **Paramètres** `options.groupBy` *(Array<string|GroupAggregation>)* – Champs, colonnes ou expressions utilisés pour regrouper les résultats.
 - **Paramètres** `options.orderBy` *(Array<string|OrderByOption>)* – Règles de tri.
 - **Paramètres** `options.join` *(JoinOption / JoinOption[])* – Structures de configuration pour les jointures de tables.
 - **Paramètres** `options.limit` *(number)* – Nombre maximal de résultats à retourner.
@@ -177,6 +177,16 @@ Chaque élément du tableau `select` peut être soit une chaîne de caractères
 | `count` (Object)                | `Object`          | Agrégation conditionnelle automatisée (`CASE WHEN`). Idéal pour les indicateurs clés (KPIs) et statuts.   | `{ count: { deletedAt: null } }` $\rightarrow$ `COUNT(CASE WHEN `\`deletedAt\`` = NULL THEN 1 END)` |
 | `as`                            | `string`          | Définit un identifiant de sortie personnalisé ou un alias d'agrégation (SQL `AS`).                        | `{ count: 'id', as: 'total' }` $\rightarrow$ `COUNT(`\`id\``) AS `\`total\`                         |
 
+### Options Avancées de `groupBy` (`GroupAggregation`)
+
+L'option `groupBy` accepte un tableau pouvant mélanger des chaînes de caractères simples (noms de colonnes bruts) et des objets de configuration avancés pour un regroupement sécurisé, paramétré et la gestion des alias :
+
+| Propriété dans l'objet `groupBy` | Type              | Description                                                                                                                | Exemple / SQL Généré                                                                  |
+|----------------------------------|-------------------|----------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------|
+| `col`                            | `string`          | Cible de manière sécurisée une colonne de table non agrégée grâce à l'isolation structurelle de l'objet.                   | `{ col: 'role' }` → \`role\`                                                          |
+| `dateFormat`                     | `[string, string]`| Regroupe de manière sécurisée par une colonne Date formatée à l'aide d'entrées paramétrées (Format : `[colonne, format]`). | `{ dateFormat: ['created_at', '%Y-%m'] }` → `DATE_FORMAT(` \`created_at\``, '%Y-%m')` |
+| `as`                             | `string`          | Cible directement l'alias défini dans le select pour respecter les contraintes strictes de syntaxe MySQL.                  | `{ col: 'role', as: 'user_role' }` → \`user_role\`                                    |
+
 ---
 
 ### Options complexes structurées (`orderBy` & `join`)
@@ -210,7 +220,7 @@ await User.find({
     { sum: 'error' },
     { sum: 'reload' },
   ],
-  groupBy: ['period'],
+  groupBy: ['period', { dateFormat: ['date_day', '%Y-%m'] }],
   orderBy: [{ field: 'period', direction: 'ASC' }],
   limit: 10
 });
@@ -264,9 +274,7 @@ const ppiStats = await ProjectPipeline.find({
     team: 'GROUP-1'
   }
 });
-
-// Format du tableau de sortie retourné : [{ active: 6, total_success: 42 }]
-```
+  ```
 
 #### 3. Jointures de tables, groupement temporel et tri multi-colonnes
 
@@ -281,13 +289,18 @@ const history = await ProjectPipeline.find({
     { dateFormat: ['MyTable.created_at', '%Y-%m'], as: 'period' },
     { count: 'MyTable.id', as: 'pipelines_count' }
   ],
-  where: "MyTable.deletedAt IS NULL", // Les chaînes de conditions brutes sont autorisées
+  where: {
+    status: 'ACTIVE'
+  },
   join: {
     table: 'Projects',
     on: 'MyTable.project_id = Projects.id',
     type: 'LEFT'
   },
-  groupBy: ['project_name', 'period'],
+  groupBy: [
+    'project_name',
+    { dateFormat: ['ProjectPipelines.created_at', '%Y-%m'] }
+  ],
   orderBy: [
     { field: 'period', direction: 'DESC' },
     { field: 'project_name', direction: 'ASC' }
@@ -389,7 +402,7 @@ const User = require("user");
 const uuid = await User.generate_uuid();
 const my_uuid = await User.generate_uuid("my_uuid");
 
-await User.save{ email: "user@example.com", status: "active", uuid: uuid, my_uuid: my_uuid }
+await User.save({ email: "user@example.com", status: "active", uuid: uuid, my_uuid: my_uuid })
 ```
 
 ## Instances de modèle

package/index.d.ts

@@ -11,7 +11,19 @@ export type SqlType =
     | "Float"
     | "Text"
     | "DateTime"
-    | "Timestamp";
+    | "Timestamp"
+    | "CurrentTimestamp";
+
+export interface SqlTypeMap {
+    String: string;
+    Number: string;
+    Date: string;
+    CurrentTimestamp: string; // Ajout de la propriété demandée
+    [key: string]: any;       // Permet d'accueillir d'autres types SQL généraux
+}
+
+export const sqlTypeMap: SqlTypeMap;
+
 export type SqlTypeConstructor =
     | StringConstructor
     | NumberConstructor
@@ -39,39 +51,76 @@ export interface SchemaDict {
     [key: string]: SchemaField;
 }
 
+export type SelectAggregation = {
+    col?: string;
+    sum?: string;
+    distinct?: string;
+    dateFormat?: [string, string];
+    count?: string | string[] | Record<string, any>;
+    as?: string;
+};
+
+export type SelectItem = string | SelectAggregation;
+
+export type WhereOperator =
+    | "="
+    | "!="
+    | ">"
+    | "<"
+    | ">="
+    | "<="
+    | "LIKE"
+    | "IN"
+    | "NOT IN";
+
+export type WhereOperatorObject = {
+    [K in WhereOperator]?: any;
+};
+
+export interface WhereClause {
+    AND?: WhereClause[];
+    OR?: WhereClause[];
+
+    [key: string]:
+    | any
+    | WhereClause[]
+    | WhereOperatorObject
+    | undefined;
+}
+
 type NormalizeSqlType<T> =
     T extends StringConstructor
-            ? "String"
-            : T extends NumberConstructor
-                ? "Number"
-                : T extends BooleanConstructor
-                    ? "Boolean"
-                    : T extends DateConstructor
-                        ? "Date"
-                        : T extends ObjectConstructor
-                            ? "Object"
-                            : T extends ArrayConstructor
-                                ? "Array"
-                                : T extends SqlType
-                                    ? T
-                                    : T extends { name: SqlType }
-                                        ? T["name"]
-                                        : never;
+    ? "String"
+    : T extends NumberConstructor
+    ? "Number"
+    : T extends BooleanConstructor
+    ? "Boolean"
+    : T extends DateConstructor
+    ? "Date"
+    : T extends ObjectConstructor
+    ? "Object"
+    : T extends ArrayConstructor
+    ? "Array"
+    : T extends SqlType
+    ? T
+    : T extends { name: SqlType }
+    ? T["name"]
+    : never;
 
 type InferSqlType<T> =
     NormalizeSqlType<T> extends "String" | "Text"
-        ? string
-        : NormalizeSqlType<T> extends "Number" | "Float"
-            ? number
-            : NormalizeSqlType<T> extends "Boolean"
-                ? boolean
-                : NormalizeSqlType<T> extends "Date" | "DateTime" | "Timestamp" | "Now"
-                    ? Date
-                    : NormalizeSqlType<T> extends "Object"
-                        ? Record<string, unknown>
-                        : NormalizeSqlType<T> extends "Array"
-                            ? unknown[]
-                            : unknown;
+    ? string
+    : NormalizeSqlType<T> extends "Number" | "Float"
+    ? number
+    : NormalizeSqlType<T> extends "Boolean"
+    ? boolean
+    : NormalizeSqlType<T> extends "Date" | "DateTime" | "Timestamp" | "Now"
+    ? Date
+    : NormalizeSqlType<T> extends "Object"
+    ? Record<string, unknown>
+    : NormalizeSqlType<T> extends "Array"
+    ? unknown[]
+    : unknown;
 
 type HasKey<T, K extends PropertyKey> = K extends keyof T ? true : false;
 
@@ -80,21 +129,21 @@ type InferFieldValue<TField> =
 
 type InferFieldNullable<TField> =
     TField extends { required: true }
-        ? false
-        : TField extends { primary_key: true }
-            ? false
-            : TField extends { auto_increment: true }
-                ? false
-                : TField extends { default: null }
-                    ? true
-                : HasKey<TField, "default"> extends true
-                    ? false
-                    : true;
+    ? false
+    : TField extends { primary_key: true }
+    ? false
+    : TField extends { auto_increment: true }
+    ? false
+    : TField extends { default: null }
+    ? true
+    : HasKey<TField, "default"> extends true
+    ? false
+    : true;
 
 export type InferSchema<TSchema extends SchemaDict> = {
     [K in keyof TSchema]: InferFieldNullable<TSchema[K]> extends true
-        ? InferFieldValue<TSchema[K]> | null
-        : InferFieldValue<TSchema[K]>;
+    ? InferFieldValue<TSchema[K]> | null
+    : InferFieldValue<TSchema[K]>;
 };
 
 export type SchemaLike<TSchema extends SchemaDict = SchemaDict> =
@@ -193,8 +242,8 @@ export class Model<TSchema extends SchemaDict = SchemaDict> {
      * @returns {Promise<Array<Object>>}
      */
     find(options?: {
-        select?: string[];
-        where?: Record<string, any> | Partial<InferSchema<TSchema>> | string;
+        select?: SelectItem[];
+        where?: WhereClause
         order?: [string, string][];
         limit?: number;
     }): Promise<Array<ModelRecord<InferSchema<TSchema>>>>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mlagie/sql-connector",
-  "version": "2.1.3",
+  "version": "2.2.0",
   "description": "The sql-connector module allows you to manage connections to a MySQL database, define table schemas, and interact with data in a simple and efficient way.",
   "main": "index.js",
   "exports": {
@@ -21,7 +21,7 @@
     "test:publish": "npm publish --dry-run",
     "test:watch": "node --experimental-vm-modules node_modules/jest/bin/jest.js --watch",
     "test:coverage": "rm -r coverage ; node --experimental-vm-modules node_modules/jest/bin/jest.js --coverage",
-    "coverage:report": "node scripts/coverage-report.js",
+    "coverage:report": "./scripts/coverage-report.sh",
     "security": "npx eslint . --max-warnings 0 --ignore-pattern './tests/*'"
   },
   "repository": {

package/src/models/Model.js

@@ -1,8 +1,6 @@
 const { logs, error } = require("@mlagie/logger");
 const { sqlTypeMap } = require("../utils/sqlTypeMap");
 const { getConnexion } = require("../db/connexion");
-const generateCondition = require("../utils/generateCondition");
-const formatObject = require("../utils/formatObject");
 const { ModelInstance } = require("./ModelInstance");
 const { buildSelect, buildQueryParts } = require("../utils/buildQuery/buildQuery");
 const { getSafe, setSafe } = require("../utils/security/safe");
@@ -52,29 +50,6 @@ function formatDefaultSql(defaultValue, fieldType) {
     return `DEFAULT "${String(defaultValue).replace(/"/g, '\\"')}"`;
 }
 
-const reservedKeywords = ['ADD', 'ALL', 'ALTER', 'AND', 'AS', 'ASC', 'BETWEEN', 'BY', 'CASE', 'CHECK', 'COLUMN', 'CONSTRAINT', 'CREATE', 'CURRENT_DATE', 'CURRENT_TIME', 'CURRENT_TIMESTAMP', 'DEFAULT', 'DELETE', 'DESC', 'DISTINCT', 'DROP', 'ELSE', 'END', 'ESCAPE', 'EXCEPT', 'EXISTS', 'FOR', 'FOREIGN', 'FROM', 'FULL', 'GROUP', 'HAVING', 'IN', 'INNER', 'INSERT', 'INTERSECT', 'INTO', 'IS', 'JOIN', 'LEFT', 'LIKE', 'LIMIT', 'NOT', 'NULL', 'ON', 'OR', 'ORDER', 'OUTER', 'PRIMARY', 'REFERENCES', 'RIGHT', 'SELECT', 'SET', 'SOME', 'TABLE', 'THEN', 'UNION', 'UNIQUE', 'UPDATE', 'VALUES', 'WHEN', 'WHERE'];
-
-/**
- * Checks if a table name is a reserved keyword.
- * 
- * @param {string} tableName The name of the table to be checked.
- * @returns {boolean} `true` if the table name is a reserved keyword, otherwise `false`.
- * 
- * @example
- * const isReserved = ifReservedKeywords('SELECT');
- * console.log(isReserved); // true
- *
- * @example
- * const isReserved = ifReservedKeywords('myTable');
- * console.log(isReserved); // false
- */
-function ifReservedKeywords(tableName) {
-    if (reservedKeywords.includes(tableName.toUpperCase())) {
-        return true;
-    }
-    return false;
-}
-
 function getColumnDefinition(fieldName, field) {
     if (field.primary_key && field.unique) {
         throw new Error(`Field '${fieldName}' cannot be both PRIMARY KEY and UNIQUE.`);
@@ -115,6 +90,8 @@ class Model {
      * @param {Object} schema The schema of the database table.
      */
     constructor(name, schema) {
+        if (!name || typeof name !== "string") throw new Error("Model name must be a non-empty string.");
+        if (!schema || typeof schema !== "object") throw new Error("Model schema must be a non-empty object.");
         this.name = name;
         this.schema = schema;
 
@@ -207,10 +184,6 @@ class Model {
 
             return `${fieldName} ${type == "VARCHAR" ? `${type}(${lengthDefault})` : type}`;
         });
-        if (ifReservedKeywords(this.name)) {
-            error("Error: Invalid table name. Please choose a different name that is not a reserved keyword in SQL_request");
-            return;
-        }
         return `CREATE TABLE IF NOT EXISTS ${escapeIdentifier(this.name)} (${columns.join(', ')}${foreignKey.length > 0 ? ", " + foreignKey.join(', ') : ""}) ENGINE=InnoDB`;
     }
 
@@ -292,10 +265,11 @@ class Model {
             joinClause = ` INNER JOIN ${escapeIdentifier(join.table)} ON ${join.on}`;
         }
 
-        const query = `SELECT ${buildSelect(select)} FROM ${escapeIdentifier(this.name)}${joinClause} ${buildQueryParts(options)}`;
+        const { sql: whereClause, values } = buildQueryParts(options);
+        const query = `SELECT ${buildSelect(select)} FROM ${escapeIdentifier(this.name)}${joinClause} ${whereClause}`;
 
         try {
-            const result = await getConnexion().promise().execute(query);
+            const result = await getConnexion().promise().execute(query, values);
             const rows = result && Array.isArray(result) ? result[0] : result;
 
             if (!rows || rows.length === 0) return [];
@@ -314,7 +288,9 @@ class Model {
      */
     async count(filter) {
         try {
-            const rows = await getConnexion().promise().execute(`SELECT COUNT(*) as count FROM ${escapeIdentifier(this.name)} ${filter != undefined ? `WHERE ${generateCondition(formatObject(filter))}` : ""}`);
+            const { sql: whereClause, values } = buildQueryParts(filter);
+
+            const rows = await getConnexion().promise().execute(`SELECT COUNT(*) as count FROM ${escapeIdentifier(this.name)} ${whereClause}`, values);
             const resultRows = rows && Array.isArray(rows) ? rows[0] : [];
 
             if (!resultRows || resultRows.length === 0) return 0;
@@ -358,9 +334,11 @@ class Model {
      * @throws {Error} Throws an error if the SQL query fails.
      */
     async delete(filter) {
-        const sql_request = `DELETE FROM ${escapeIdentifier(this.name)} WHERE ${generateCondition(formatObject(filter))}`;
+        const { sql: whereClause, values } = buildQueryParts(filter);
+
+        const sql_request = `DELETE FROM ${escapeIdentifier(this.name)} WHERE ${whereClause}`;
         return new Promise((resolve, reject) => {
-            getConnexion().promise().execute(sql_request).then((rows) => {
+            getConnexion().promise().execute(sql_request, values).then((rows) => {
                 if (rows[0].affectedRows === 0) return resolve(0);
 
                 return resolve(1);
@@ -421,7 +399,7 @@ class Model {
             return null;
         } catch (err) {
             error(`Error executing query gen_uuid: ${err}`);
-            return null; // Retourne null en cas de plantage SQL
+            return null;
         }
     }
 }

package/src/models/ModelInstance.js

@@ -1,8 +1,7 @@
 const { error } = require("@mlagie/logger");
 const { getConnexion } = require("../db/connexion");
-const formatObject = require("../utils/formatObject");
-const generateCondition = require("../utils/generateCondition");
 const { getSafe, setSafe } = require("../utils/security/safe");
+const { buildQueryParts } = require("../utils/buildQuery/buildQuery");
 
 /**
  * Represents an instance of a database model.
@@ -82,12 +81,16 @@ class ModelInstance {
      * @throws {Error} Throws an error if the update fails.
      */
     async updateOne(model) {
-        const setClause = generateCondition(formatObject(model), true);
+        // 1. Paramétrisation sécurisée de la clause SET
+        const setKeys = Object.keys(model);
+        if (setKeys.length === 0) return 0;
 
-        let whereClause;
+        const setClause = setKeys.map(key => `\`${key}\` = ?`).join(', ');
+        const values = Object.values(model); // On accumule les valeurs à modifier
+
+        let targetCriteria;
         try {
             const recordsArray = this.getRecordData();
-
             let rawRec = Array.isArray(recordsArray) ? recordsArray[0] : recordsArray;
 
             if (typeof rawRec === 'string') {
@@ -101,38 +104,48 @@ class ModelInstance {
                 if (pkKeys.length > 0) {
                     const pkObj = {};
                     for (const k of pkKeys) {
-                        if (rec && Object.prototype.hasOwnProperty.call(rec, k)) setSafe(pkObj, k, getSafe(rec, k));
+                        if (rec && Object.prototype.hasOwnProperty.call(rec, k)) {
+                            setSafe(pkObj, k, getSafe(rec, k));
+                        }
                     }
-                    if (Object.keys(pkObj).length > 0) whereClause = generateCondition(formatObject(pkObj), false, this._schema);
+                    if (Object.keys(pkObj).length > 0) targetCriteria = pkObj;
                 }
             }
-            if (!whereClause) whereClause = generateCondition(formatObject(rec), false, this._schema);
+            if (!targetCriteria) targetCriteria = rec;
         } catch {
             const originalFallbackRec = this.getRecordData();
             let fallbackRec = originalFallbackRec;
             if (Array.isArray(fallbackRec)) fallbackRec = fallbackRec[0];
-            if (typeof fallbackRec === 'string') { try { fallbackRec = JSON.parse(fallbackRec); } catch { fallbackRec = originalFallbackRec; } }
-            whereClause = generateCondition(formatObject(fallbackRec), false, this._schema);
+            if (typeof fallbackRec === 'string') {
+                try { fallbackRec = JSON.parse(fallbackRec); } catch { fallbackRec = originalFallbackRec; }
+            }
+            targetCriteria = fallbackRec;
         }
 
-        const sql_request = `UPDATE ${this._name} SET ${setClause} WHERE ${whereClause}`;
-        const [result] = await getConnexion().promise().execute(sql_request).catch((err) => {
-            error(`Error executing query updateOne: ${err}`);
-            throw err;
-        });
+        const { sql: whereClause, values: whereValues } = buildQueryParts({ where: targetCriteria });
+
+        values.push(...whereValues);
 
-        const affected = result && (result.affectedRows !== undefined ? result.affectedRows : 0);
+        const sql_request = `UPDATE \`${this._name}\` SET ${setClause} ${whereClause}`;
 
-        if (affected > 0) {
-            const record = this.getRecordData();
-            if (Array.isArray(this._data)) {
-                if (this._data[0] && typeof this._data[0] === 'object') Object.assign(this._data[0], model);
-            } else if (record && typeof record === 'object') {
-                Object.assign(this._data, model);
+        try {
+            const [result] = await getConnexion().promise().execute(sql_request, values);
+            const affected = result && (result.affectedRows !== undefined ? result.affectedRows : 0);
+
+            if (affected > 0) {
+                const record = this.getRecordData();
+                if (Array.isArray(this._data)) {
+                    if (this._data[0] && typeof this._data[0] === 'object') Object.assign(this._data[0], model);
+                } else if (record && typeof record === 'object') {
+                    Object.assign(this._data, model);
+                }
             }
-        }
 
-        return affected;
+            return affected;
+        } catch (err) {
+            error(`Error executing query updateOne: ${err}`);
+            throw err;
+        }
     }
 
     /**
@@ -142,9 +155,11 @@ class ModelInstance {
      * @throws {Error} Throws an error if the deletion fails.
      */
     async delete(filter) {
-        const sql_request = `DELETE FROM ${this._name} WHERE ${generateCondition(formatObject(filter))}`;
+        const { sql: whereClause, values } = buildQueryParts(filter);
+
+        const sql_request = `DELETE FROM ${this._name} ${whereClause}`;
 
-        const rows = await getConnexion().promise().execute(sql_request).catch((err) => {
+        const rows = await getConnexion().promise().execute(sql_request, values).catch((err) => {
             error(`Error executing query delete: ${err}`);
             throw err;
         });
@@ -158,8 +173,9 @@ class ModelInstance {
      * @throws {Error} Throws an error if the deletion fails.
      */
     async deleteOne() {
-        const sql_request = `DELETE FROM ${this._name} WHERE ${generateCondition(formatObject(this.getRecordData()))}`;
-        const rows = await getConnexion().promise().execute(sql_request).catch((err) => {
+        const { sql: whereClause, values } = buildQueryParts(this.getRecordData());
+        const sql_request = `DELETE FROM ${this._name} ${whereClause}`;
+        const rows = await getConnexion().promise().execute(sql_request, values).catch((err) => {
             error(`Error executing query deleteOne: ${err}`);
             throw err;
         });

package/src/utils/buildQuery/buildQuery.js

@@ -1,25 +1,26 @@
-const formatObject = require("../formatObject");
-const generateCondition = require("../generateCondition");
 const { escapeIdentifier, escapeOrderDirection, escapeValue } = require("../sql");
 const count = require("./count");
 
 function buildGroupByItem(group) {
-    if (typeof group !== 'string') {
-        throw new Error("Group by items must be strings");
+    let sql;
+    if (typeof group !== 'string' && typeof group !== 'object') {
+        throw new Error("Group by items must be strings or objects");
     }
-
-    const trimmedGroup = group.trim();
-
-    if (/^DATE_FORMAT\(/i.test(trimmedGroup)) {
-        const match = trimmedGroup.match(/^DATE_FORMAT\(([^,]+),\s*('(?:[^'\\]|\\.)*'|"(?:[^"\\]|\\.)*")\)$/i);
-        if (match) {
-            const column = match[1].trim();
-            const format = match[2].slice(1, -1).replace(/\\'/g, "'").replace(/\\"/g, '"');
-            return `DATE_FORMAT(${escapeIdentifier(column)}, ${escapeValue(format)})`;
+    if (typeof group === 'object') {
+        if (group.dateFormat) {
+            const [col, format] = group.dateFormat;
+            sql = `DATE_FORMAT(${escapeIdentifier(col)}, ${escapeValue(format)})`;
+        }
+        if (group.col) {
+            sql = escapeIdentifier(group.col);
         }
+        if (group.as) {
+            sql += ` AS ${escapeIdentifier(group.as)}`;
+        }
+        return sql;
     }
 
-    return escapeIdentifier(trimmedGroup);
+    return escapeIdentifier(group.trim());
 }
 
 function buildField(field) {
@@ -59,16 +60,92 @@ function buildSelect(select = []) {
         .join(',\n');
 }
 
+function buildWhere(where, values = []) {
+    const conditions = [];
+
+    for (const [key, value] of Object.entries(where)) {
+        if (key === "OR") {
+            if (value.length === 0) {
+                throw new Error("OR conditions cannot be empty");
+            }
+            const clauses = value
+                .map((item) => buildWhere(item, values))
+                .filter(Boolean);
+
+            if (clauses.length) {
+                conditions.push(`(${clauses.join(" OR ")})`);
+            }
+
+            continue;
+        }
+
+        if (key === "AND") {
+            if (value.length === 0) {
+                throw new Error("AND conditions cannot be empty");
+            }
+            const clauses = value
+                .map((item) => buildWhere(item, values))
+                .filter(Boolean);
+
+            if (clauses.length) {
+                conditions.push(`(${clauses.join(" AND ")})`);
+            }
+
+            continue;
+        }
+
+        if (value && typeof value === "object" && !Array.isArray(value)) {
+            const operators = Object.keys(value);
+
+            const isOperatorObject = operators.some((op) =>
+                ["=", "!=", ">", "<", ">=", "<=", "LIKE", "IN", "NOT IN"].includes(op)
+            );
+
+            if (isOperatorObject) {
+                for (const [operator, operatorValue] of Object.entries(value)) {
+                    if (operator === "IN" || operator === "NOT IN") {
+                        const placeholders = operatorValue
+                            .map(() => "?")
+                            .join(",");
+
+                        conditions.push(
+                            `${escapeIdentifier(key)} ${operator} (${placeholders})`
+                        );
+                        values.push(...operatorValue);
+                    } else {
+                        conditions.push(`${escapeIdentifier(key)} ${operator} ?`);
+                        values.push(operatorValue);
+                    }
+                }
+
+                continue;
+            }
+        }
+
+        conditions.push(`${escapeIdentifier(key)} = ?`);
+        values.push(value);
+    }
+
+    return conditions.join(" AND ");
+}
+
+/**
+ * Construit les parties de la requête et extrait les valeurs sécurisées
+ * @param {Object} options Options de filtrage, tri et pagination
+ * @returns {Object} Un objet contenant la chaîne SQL générée et le tableau des valeurs { sql, values }
+ */
 function buildQueryParts(options) {
     const parts = [];
+    const values = [];
 
+    if (!options) {
+        return { sql: '', values: [] };
+    }
     if (options.where) {
-        if (typeof options.where === 'string') {
-            if (options.where.trim().toUpperCase().startsWith("WHERE ")) throw new Error("Raw string WHERE clauses are not allowed. Use a structured filter instead.");
-            else parts.push(`WHERE ${options.where}`);
-        } else {
-            parts.push(`WHERE ${generateCondition(formatObject(options.where))}`);
+        if (typeof options.where !== 'object' || Array.isArray(options.where)) {
+            throw new Error("Raw string WHERE clauses are not allowed. Use a structured filter instead.");
         }
+        parts.push(`WHERE ${buildWhere(options.where, values)}`);
     }
 
     if (options.groupBy) {
@@ -92,10 +169,15 @@ function buildQueryParts(options) {
         if (!Number.isInteger(options.limit) || options.limit < 0) {
             throw new Error("Invalid LIMIT value");
         }
-        parts.push(`LIMIT ${options.limit}`);
+        
+        parts.push(`LIMIT ?`);
+        values.push(options.limit);
     }
 
-    return parts.join('\n\n');
+    return {
+        sql: parts.join('\n\n'),
+        values: values
+    };
 }
 
-module.exports = { buildQueryParts, buildSelect }
+module.exports = { buildQueryParts, buildSelect };

package/src/utils/formatObject.js

@@ -1,34 +0,0 @@
-const { getSafe, setSafe } = require("./security/safe");
-
-module.exports = function (obj) {
-    for (const key in obj) {
-        if (Object.prototype.hasOwnProperty.call(obj, key)) {
-            const value = getSafe(obj, key);
-
-            if (value instanceof Date) {
-                // convert Date to MySQL DATETIME (no timezone)
-                setSafe(obj, key, value.toISOString().slice(0, 19).replace('T', ' '));
-                continue;
-            }
-
-            if (typeof value === "string") {
-                // remove surrounding quotes if present and unescape
-                let v = value.trim();
-                // remove wrapping double or single quotes
-                if ((v.startsWith('"') && v.endsWith('"')) || (v.startsWith("'") && v.endsWith("'"))) {
-                    v = v.slice(1, -1);
-                }
-                // unescape common escaped quotes
-                v = v.replace(/\\"/g, '"').replace(/\\'/g, "'");
-                setSafe(obj, key, v);
-                continue;
-            }
-
-            if (typeof value === "object") {
-                // stringify objects and escape single quotes for SQL safety
-                setSafe(obj, key, JSON.stringify(value).replace(/'/g, "\\'"));
-            }
-        }
-    }
-    return obj;
-}

package/src/utils/generateCondition.js

@@ -1,105 +0,0 @@
-const { getSafe } = require("./security/safe");
-const { escapeIdentifier, escapeValue } = require("./sql");
-
-/**
- * Generates an SQL_request condition from a filter object.
- * 
- * @param {Object} filter An object containing the key-value pairs to use to generate the condition.
- * @param {boolean} [isUpdate=false] A flag to determine whether the condition is used in an update request.
- * @returns {string} A character string representing the generated SQL_request condition.
- * 
- * @example
- * const filter = { id: 1, name: "John" };
- * const condition = generateCondition(filter);
- * console.log(condition); // 'id = 1 AND name = "John"'
- *
- * @example
- * const filter = { id: 1, name: "John" };
- * const condition = generateCondition(filter, true);
- * console.log(condition); // 'id = 1, name = "John"'
- */
-module.exports = function (filter, isUpdate = false, schema = null) {
-    const keys = Object.keys(filter);
-    const values = Object.values(filter);
-
-    const filteredKeys = isUpdate ? keys.filter(key => getSafe(filter, key) !== undefined) : keys;
-    const filteredValues = isUpdate ? filteredKeys.map(key => getSafe(filter, key)) : values;
-
-    if (!isUpdate && schema && schema.schemaDict) {
-        const uniqueKeys = filteredKeys.filter(key => {
-            const field = getSafe(schema.schemaDict, key);
-            return field && field.unique === true;
-        });
-        if (uniqueKeys.length > 0) {
-            return uniqueKeys.map(key => {
-                let value = getSafe(filter, key);
-                const escapedKey = escapeIdentifier(key);
-                // normalize strings that may contain surrounding quotes or escaped quotes
-                if (typeof value === 'string') {
-                    value = value.trim();
-                    value = value.replace(/\\"/g, '"').replace(/\\'/g, "'");
-                }
-                if (Array.isArray(value)) {
-                    return `${escapedKey} IN (${value.map(v => escapeValue(v)).join(", ")})`;
-                }
-                if (typeof value === "object" && value !== null || (typeof value === "string" && value.trim().startsWith("{") && value.trim().endsWith("}"))) {
-                    const jsonVal = typeof value === "string" ? value : JSON.stringify(value);
-                    return `JSON_CONTAINS(${escapedKey}, ${escapeValue(jsonVal)})`;
-                }
-                if (value === null || value === "null") return `${escapedKey} IS NULL`;
-                // if string looks like an ISO datetime, convert to MySQL DATETIME format
-                if (typeof value === 'string' && /T/.test(value)) {
-                    let val = value.replace(/\.\d+Z$/,'').replace(/Z$/,'').replace('T',' ');
-                    return `${escapedKey} = ${escapeValue(val)}`;
-                }
-                return `${escapedKey} = ${escapeValue(value)}`;
-            }).join(" AND ");
-        }
-    }
-
-    // Comportement par défaut
-    const conditions = filteredKeys.map((key, index) => {
-        let value = getSafe(filteredValues, index);
-        const escapedKey = escapeIdentifier(key);
-
-        if (typeof value === 'string') {
-            value = value.trim();
-            value = value.replace(/\\"/g, '"').replace(/\\'/g, "'");
-        }
-
-        if (Array.isArray(value)) {
-            return `${escapedKey} IN (${value.map(v => escapeValue(v)).join(", ")})`;
-        }
-        if (typeof value === "object" && value !== null || (typeof value === "string" && value.trim().startsWith("{") && value.trim().endsWith("}"))) {
-            const jsonVal = typeof value === "string" ? value : JSON.stringify(value);
-            if (isUpdate) {
-                return `${escapedKey} = ${escapeValue(jsonVal)}`;
-            }
-            return `JSON_CONTAINS(${escapedKey}, ${escapeValue(jsonVal)})`;
-        }
-
-        if ((value === null || value === "null") && isUpdate == false) return `${escapedKey} IS NULL`;
-
-        // handle date-like strings when schema tells us the field is temporal
-        const fieldDef = schema && schema.schemaDict ? getSafe(schema.schemaDict, key) : null;
-        let fieldType = null;
-        if (fieldDef) {
-            if (fieldDef.type && fieldDef.type.name !== undefined) fieldType = fieldDef.type.name;
-            else if (fieldDef.type !== undefined) fieldType = fieldDef.type;
-        }
-        const normalizedFieldType = String(fieldType ?? "").toLowerCase();
-        const isDateLike = ["date", "datetime", "timestamp", "now"].includes(normalizedFieldType);
-
-        if (typeof value === "string") {
-            let val = value;
-            if ((val.startsWith('"') && val.endsWith('"')) || (val.startsWith("'") && val.endsWith("'"))) val = val.slice(1,-1);
-            // if ISO timestamp with Z, convert to MySQL DATETIME format
-            if (isDateLike && /T/.test(val)) {
-                val = val.replace(/\.\d+Z$/,'').replace(/Z$/,'').replace('T',' ');
-            }
-            return `${escapedKey} = ${escapeValue(val)}`;
-        }
-        return `${escapedKey} = ${escapeValue(value)}`;
-    }).join(` ${isUpdate == false ? "AND" : ","} `);
-    return conditions;
-}