@openfn/language-mssql 5.0.14 → 5.1.0

package/ast.json

@@ -74,6 +74,42 @@
             },
             "name": "filter"
           },
+          {
+            "title": "param",
+            "description": "The uuid column to determine a matching/existing record",
+            "type": {
+              "type": "NameExpression",
+              "name": "string"
+            },
+            "name": "filter.uuid"
+          },
+          {
+            "title": "param",
+            "description": "The table to lookup the value in",
+            "type": {
+              "type": "NameExpression",
+              "name": "string"
+            },
+            "name": "filter.relation"
+          },
+          {
+            "title": "param",
+            "description": "The condition to use for the lookup. Values are automatically escaped for security.",
+            "type": {
+              "type": "NameExpression",
+              "name": "object"
+            },
+            "name": "filter.where"
+          },
+          {
+            "title": "param",
+            "description": "The operator to use for the lookup",
+            "type": {
+              "type": "NameExpression",
+              "name": "object"
+            },
+            "name": "filter.operator"
+          },
           {
             "title": "returns",
             "description": null,
@@ -84,7 +120,7 @@
           }
         ]
       },
-      "valid": true
+      "valid": false
     },
     {
       "name": "insert",

package/dist/index.cjs

@@ -45,7 +45,8 @@ __export(src_exports, {
   sql: () => sql,
   upsert: () => upsert,
   upsertIf: () => upsertIf,
-  upsertMany: () => upsertMany
+  upsertMany: () => upsertMany,
+  util: () => util_exports
 });
 module.exports = __toCommonJS(src_exports);
 
@@ -80,6 +81,22 @@ __export(Adaptor_exports, {
   upsertMany: () => upsertMany
 });
 var import_language_common = require("@openfn/language-common");
+
+// src/util.js
+var util_exports = {};
+__export(util_exports, {
+  escape: () => escape
+});
+function escape(stringExp) {
+  if (typeof stringExp === "object" && stringExp !== null) {
+    return Object.values(stringExp).map((x) => escape(x));
+  } else if (typeof stringExp !== "string") {
+    return stringExp;
+  }
+  return stringExp.replace(/\'/g, "''");
+}
+
+// src/Adaptor.js
 var import_tedious = require("tedious");
 var import_language_common2 = require("@openfn/language-common");
 function createConnection(state) {
@@ -138,10 +155,9 @@ function execute(...operations) {
   };
 }
 function cleanupState(state) {
-  if (state.connection) {
-    state.connection.close();
-  }
-  delete state.connection;
+  var _a;
+  (_a = state == null ? void 0 : state.connection) == null ? void 0 : _a.close();
+  state == null ? true : delete state.connection;
   return state;
 }
 function addRowsToRefs(state, rows) {
@@ -232,14 +248,6 @@ function handleOptions(options) {
   }
   return options && options.setNull || "'undefined'";
 }
-function escapeQuote(stringExp) {
-  if (typeof stringExp === "object" && stringExp !== null) {
-    return Object.values(stringExp).map((x) => escapeQuote(x));
-  } else if (typeof stringExp !== "string") {
-    return stringExp;
-  }
-  return stringExp.replace(/\'/g, "''");
-}
 function findValue(filter) {
   return (state) => {
     const { connection } = state;
@@ -247,10 +255,12 @@ function findValue(filter) {
     const whereData = (0, import_language_common.expandReferences)(where)(state);
     const operatorData = (0, import_language_common.expandReferences)(operator)(state);
     let conditionsArray = [];
-    for (let key in whereData)
+    for (let key in whereData) {
+      const escapedValue = escape(whereData[key]);
       conditionsArray.push(
-        `${key} ${operatorData ? operatorData[key] : "="} '${whereData[key]}'`
+        `${key} ${operatorData ? operatorData[key] : "="} '${escapedValue}'`
       );
+    }
     const condition = conditionsArray.length > 0 ? `where ${conditionsArray.join(" and ")}` : "";
     try {
       const body = `select ${uuid} from ${relation} ${condition}`;
@@ -261,13 +271,15 @@ function findValue(filter) {
         const request = new import_tedious.Request(body, (err, rowCount, rows) => {
           if (err) {
             console.error(err.message);
-            throw err;
+            reject(err);
           } else {
             if (rows.length > 0) {
               returnValue = rows[0][0].value;
             }
-            if (returnValue === null)
+            if (returnValue === null) {
+              console.log("No value found");
               resolve(void 0);
+            }
             resolve(returnValue);
           }
         });
@@ -285,7 +297,7 @@ function insert(table, record, options) {
     try {
       const recordData = (0, import_language_common.expandReferences)(record)(state);
       const columns = Object.keys(recordData).sort();
-      const values = columns.map((key) => escapeQuote(recordData[key])).join("', '");
+      const values = columns.map((key) => escape(recordData[key])).join("', '");
       const query = handleValues(
         `INSERT INTO ${table} (${columns.join(", ")}) VALUES ('${values}');`,
         handleOptions(options)
@@ -311,7 +323,7 @@ function insertMany(table, records, options) {
       const recordData = (0, import_language_common.expandReferences)(records)(state);
       const columns = Object.keys(recordData[0]);
       const valueSets = recordData.map(
-        (x) => `('${escapeQuote(Object.values(x)).join("', '")}')`
+        (x) => `('${escape(Object.values(x)).join("', '")}')`
       );
       const query = handleValues(
         `INSERT INTO ${table} (${columns.join(", ")}) VALUES ${valueSets.join(
@@ -339,8 +351,8 @@ function upsert(table, uuid, record, options) {
     try {
       const recordData = (0, import_language_common.expandReferences)(record)(state);
       const columns = Object.keys(recordData).sort();
-      const selectValues = columns.map((key) => `'${escapeQuote(recordData[key])}' AS ${key}`).join(", ");
-      const updateValues = columns.map((key) => `[Target].${key}='${escapeQuote(recordData[key])}'`).join(", ");
+      const selectValues = columns.map((key) => `'${escape(recordData[key])}' AS ${key}`).join(", ");
+      const updateValues = columns.map((key) => `[Target].${key}='${escape(recordData[key])}'`).join(", ");
       const insertColumns = columns.join(", ");
       const insertValues = columns.map((key) => `[Source].${key}`).join(", ");
       const constraint = [];
@@ -392,8 +404,8 @@ function upsertIf(logical, table, uuid, record, options) {
           resolve(state);
           return state;
         }
-        const selectValues = columns.map((key) => `'${escapeQuote(recordData[key])}' AS ${key}`).join(", ");
-        const updateValues = columns.map((key) => `[Target].${key}='${escapeQuote(recordData[key])}'`).join(", ");
+        const selectValues = columns.map((key) => `'${escape(recordData[key])}' AS ${key}`).join(", ");
+        const updateValues = columns.map((key) => `[Target].${key}='${escape(recordData[key])}'`).join(", ");
         const insertColumns = columns.join(", ");
         const insertValues = columns.map((key) => `[Source].${key}`).join(", ");
         const constraint = [];
@@ -443,7 +455,7 @@ function upsertMany(table, uuid, records, options) {
         }
         const columns = Object.keys(recordData[0]);
         const valueSets = recordData.map(
-          (x) => `('${escapeQuote(Object.values(x)).join("', '")}')`
+          (x) => `('${escape(Object.values(x)).join("', '")}')`
         );
         const insertColumns = columns.join(", ");
         const insertValues = columns.map((key) => `[Source].${key}`).join(", ");
@@ -580,5 +592,6 @@ var src_default = Adaptor_exports;
   sql,
   upsert,
   upsertIf,
-  upsertMany
+  upsertMany,
+  util
 });

package/dist/index.js

@@ -38,6 +38,22 @@ import {
   execute as commonExecute,
   expandReferences
 } from "@openfn/language-common";
+
+// src/util.js
+var util_exports = {};
+__export(util_exports, {
+  escape: () => escape
+});
+function escape(stringExp) {
+  if (typeof stringExp === "object" && stringExp !== null) {
+    return Object.values(stringExp).map((x) => escape(x));
+  } else if (typeof stringExp !== "string") {
+    return stringExp;
+  }
+  return stringExp.replace(/\'/g, "''");
+}
+
+// src/Adaptor.js
 import { Connection, Request } from "tedious";
 import {
   alterState,
@@ -112,10 +128,9 @@ function execute(...operations) {
   };
 }
 function cleanupState(state) {
-  if (state.connection) {
-    state.connection.close();
-  }
-  delete state.connection;
+  var _a;
+  (_a = state == null ? void 0 : state.connection) == null ? void 0 : _a.close();
+  state == null ? true : delete state.connection;
   return state;
 }
 function addRowsToRefs(state, rows) {
@@ -206,14 +221,6 @@ function handleOptions(options) {
   }
   return options && options.setNull || "'undefined'";
 }
-function escapeQuote(stringExp) {
-  if (typeof stringExp === "object" && stringExp !== null) {
-    return Object.values(stringExp).map((x) => escapeQuote(x));
-  } else if (typeof stringExp !== "string") {
-    return stringExp;
-  }
-  return stringExp.replace(/\'/g, "''");
-}
 function findValue(filter) {
   return (state) => {
     const { connection } = state;
@@ -221,10 +228,12 @@ function findValue(filter) {
     const whereData = expandReferences(where)(state);
     const operatorData = expandReferences(operator)(state);
     let conditionsArray = [];
-    for (let key in whereData)
+    for (let key in whereData) {
+      const escapedValue = escape(whereData[key]);
       conditionsArray.push(
-        `${key} ${operatorData ? operatorData[key] : "="} '${whereData[key]}'`
+        `${key} ${operatorData ? operatorData[key] : "="} '${escapedValue}'`
       );
+    }
     const condition = conditionsArray.length > 0 ? `where ${conditionsArray.join(" and ")}` : "";
     try {
       const body = `select ${uuid} from ${relation} ${condition}`;
@@ -235,13 +244,15 @@ function findValue(filter) {
         const request = new Request(body, (err, rowCount, rows) => {
           if (err) {
             console.error(err.message);
-            throw err;
+            reject(err);
           } else {
             if (rows.length > 0) {
               returnValue = rows[0][0].value;
             }
-            if (returnValue === null)
+            if (returnValue === null) {
+              console.log("No value found");
               resolve(void 0);
+            }
             resolve(returnValue);
           }
         });
@@ -259,7 +270,7 @@ function insert(table, record, options) {
     try {
       const recordData = expandReferences(record)(state);
       const columns = Object.keys(recordData).sort();
-      const values = columns.map((key) => escapeQuote(recordData[key])).join("', '");
+      const values = columns.map((key) => escape(recordData[key])).join("', '");
       const query = handleValues(
         `INSERT INTO ${table} (${columns.join(", ")}) VALUES ('${values}');`,
         handleOptions(options)
@@ -285,7 +296,7 @@ function insertMany(table, records, options) {
       const recordData = expandReferences(records)(state);
       const columns = Object.keys(recordData[0]);
       const valueSets = recordData.map(
-        (x) => `('${escapeQuote(Object.values(x)).join("', '")}')`
+        (x) => `('${escape(Object.values(x)).join("', '")}')`
       );
       const query = handleValues(
         `INSERT INTO ${table} (${columns.join(", ")}) VALUES ${valueSets.join(
@@ -313,8 +324,8 @@ function upsert(table, uuid, record, options) {
     try {
       const recordData = expandReferences(record)(state);
       const columns = Object.keys(recordData).sort();
-      const selectValues = columns.map((key) => `'${escapeQuote(recordData[key])}' AS ${key}`).join(", ");
-      const updateValues = columns.map((key) => `[Target].${key}='${escapeQuote(recordData[key])}'`).join(", ");
+      const selectValues = columns.map((key) => `'${escape(recordData[key])}' AS ${key}`).join(", ");
+      const updateValues = columns.map((key) => `[Target].${key}='${escape(recordData[key])}'`).join(", ");
       const insertColumns = columns.join(", ");
       const insertValues = columns.map((key) => `[Source].${key}`).join(", ");
       const constraint = [];
@@ -366,8 +377,8 @@ function upsertIf(logical, table, uuid, record, options) {
           resolve(state);
           return state;
         }
-        const selectValues = columns.map((key) => `'${escapeQuote(recordData[key])}' AS ${key}`).join(", ");
-        const updateValues = columns.map((key) => `[Target].${key}='${escapeQuote(recordData[key])}'`).join(", ");
+        const selectValues = columns.map((key) => `'${escape(recordData[key])}' AS ${key}`).join(", ");
+        const updateValues = columns.map((key) => `[Target].${key}='${escape(recordData[key])}'`).join(", ");
         const insertColumns = columns.join(", ");
         const insertValues = columns.map((key) => `[Source].${key}`).join(", ");
         const constraint = [];
@@ -417,7 +428,7 @@ function upsertMany(table, uuid, records, options) {
         }
         const columns = Object.keys(recordData[0]);
         const valueSets = recordData.map(
-          (x) => `('${escapeQuote(Object.values(x)).join("', '")}')`
+          (x) => `('${escape(Object.values(x)).join("', '")}')`
         );
         const insertColumns = columns.join(", ");
         const insertValues = columns.map((key) => `[Source].${key}`).join(", ");
@@ -554,5 +565,6 @@ export {
   sql,
   upsert,
   upsertIf,
-  upsertMany
+  upsertMany,
+  util_exports as util
 };

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@openfn/language-mssql",
-  "version": "5.0.14",
+  "label": "MSSQL",
+  "version": "5.1.0",
   "description": "A Microsoft SQL language pack for OpenFn",
   "exports": {
     ".": {
@@ -25,13 +26,12 @@
   ],
   "dependencies": {
     "tedious": "18.6.1",
-    "@openfn/language-common": "2.4.0"
+    "@openfn/language-common": "2.5.0"
   },
   "devDependencies": {
     "assertion-error": "2.0.0",
-    "chai": "4.3.6",
+    "chai": "^5.2.0",
     "deep-eql": "4.1.1",
-    "esno": "^0.16.3",
     "rimraf": "3.0.2"
   },
   "type": "module",
@@ -39,8 +39,9 @@
   "main": "dist/index.cjs",
   "scripts": {
     "build": "pnpm clean && build-adaptor mssql",
-    "test": "mocha --experimental-specifier-resolution=node --no-warnings",
-    "test:watch": "mocha -w --experimental-specifier-resolution=node --no-warnings",
+    "test": "mocha --experimental-specifier-resolution=node --no-warnings --exclude test/integration.js --recursive",
+    "test:watch": "mocha -w --experimental-specifier-resolution=node --no-warnings --exclude test/integration.js --recursive",
+    "test:integration": "mocha --experimental-specifier-resolution=node --no-warnings test/integration.js",
     "clean": "rimraf dist types docs",
     "pack": "pnpm pack --pack-destination ../../dist",
     "lint": "eslint src"

package/types/Adaptor.d.ts

@@ -33,9 +33,18 @@ export function sql(params: object): Operation;
  *  })
  * @function
  * @param {object} filter - A filter object with the lookup table, a uuid and the condition
+ * @param {string} filter.uuid - The uuid column to determine a matching/existing record
+ * @param {string} filter.relation - The table to lookup the value in
+ * @param {object} filter.where - The condition to use for the lookup. Values are automatically escaped for security.
+ * @param {object} filter.operator - The operator to use for the lookup
  * @returns {Operation}
  */
-export function findValue(filter: object): Operation;
+export function findValue(filter: {
+    uuid: string;
+    relation: string;
+    where: object;
+    operator: object;
+}): Operation;
 /**
  * Insert a record
  * @public

package/types/index.d.ts

@@ -1,3 +1,4 @@
 export default Adaptor;
 export * from "./Adaptor";
+export * as util from "./util";
 import * as Adaptor from "./Adaptor";

package/types/util.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Escapes a string for use in an SQL query.
+ * @example <caption>Examples</caption>
+ * util.escape('test string') // 'test string'
+ * util.escape("O'Connor") // "O''Connor"
+ * util.escape('string with "quotes"') // 'string with "quotes"'
+ * util.escape('') // ''
+ * util.escape(null) // null
+ * util.escape("'; DROP TABLE users; --") // "''; DROP TABLE users; --"
+ * @param {string} stringExp - The string to escape.
+ * @returns {string} The escaped string.
+ */
+export function escape(stringExp: string): string;