@pxp-nd/flow 1.1.30 → 1.1.32

package/dist/controllers/Action.d.ts

@@ -9,7 +9,7 @@
  * @author Favio Figueroa
  *
  * Created at     : 2021-07-08 12:55:38
- * Last modified  :
+ * Last modified  : 2026-11-06 — Rensi Arteaga — @ApiDoc for OpenAPI (spec 04)
  */
 import { EntityManager } from 'typeorm';
 import { Controller } from '@pxp-nd/core';

package/dist/controllers/Action.js

@@ -10,7 +10,7 @@
  * @author Favio Figueroa
  *
  * Created at     : 2021-07-08 12:55:38
- * Last modified  :
+ * Last modified  : 2026-11-06 — Rensi Arteaga — @ApiDoc for OpenAPI (spec 04)
  */
 var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -30,9 +30,13 @@ const core_1 = require("@pxp-nd/core");
 const Action_1 = __importDefault(require("../entity/Action"));
 const FieldMap_1 = __importDefault(require("../entity/FieldMap"));
 const OriginName_1 = __importDefault(require("../entity/OriginName"));
+const FlowNdApiDocs_1 = require("../helpers/FlowNdApiDocs");
 let Action = class Action extends core_1.Controller {
     async getFieldMapByAction(params, manager) {
         const { originName } = params;
+        if (originName == null || String(originName).trim() === '') {
+            throw new core_1.PxpError(400, 'originName is required');
+        }
         const fieldMapData = await (0, core_1.__)(manager.createQueryBuilder(FieldMap_1.default, 'fm')
             .innerJoin(OriginName_1.default, 'on', 'on.originNameId = fm.originNameId')
             .where("on.name = :n ", { n: originName })
@@ -61,8 +65,9 @@ let Action = class Action extends core_1.Controller {
 __decorate([
     (0, core_1.Get)(),
     (0, core_1.DbSettings)('Orm'),
-    (0, core_1.ReadOnly)(false),
+    (0, core_1.ReadOnly)(true),
     (0, core_1.Log)(true),
+    (0, core_1.ApiDoc)(FlowNdApiDocs_1.actionGetFieldMapByActionDoc),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, typeorm_1.EntityManager]),
     __metadata("design:returntype", Promise)
@@ -72,6 +77,7 @@ __decorate([
     (0, core_1.DbSettings)('Orm'),
     (0, core_1.ReadOnly)(true),
     (0, core_1.Log)(true),
+    (0, core_1.ApiDoc)(FlowNdApiDocs_1.actionGetActionsDoc),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, typeorm_1.EntityManager]),
     __metadata("design:returntype", Promise)

package/dist/controllers/Flow.d.ts

@@ -19,6 +19,7 @@
  * 28-Sep-2023    SP06OCT23     Mercedes Zambrana      Add Validation when change off status (validateFlow, deleteflow, saveFlow, saveflowName)
  * 07-Feb-2025    8353064698    Mercedes Zambrana      Add validation for opt in page when flow si funnel change
  * 18-Feb-2025    8501163144    Mercedes Zambrana      Add publish filter
+ * 06-Nov-2026                     Rensi Arteaga         @ApiDoc for OpenAPI (spec 04)
  * ******************************************************************************
  */
 import { EntityManager } from 'typeorm';

package/dist/controllers/Flow.js

@@ -20,6 +20,7 @@
  * 28-Sep-2023    SP06OCT23     Mercedes Zambrana      Add Validation when change off status (validateFlow, deleteflow, saveFlow, saveflowName)
  * 07-Feb-2025    8353064698    Mercedes Zambrana      Add validation for opt in page when flow si funnel change
  * 18-Feb-2025    8501163144    Mercedes Zambrana      Add publish filter
+ * 06-Nov-2026                     Rensi Arteaga         @ApiDoc for OpenAPI (spec 04)
  * ******************************************************************************
  */
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
@@ -67,10 +68,16 @@ const NodeConnection_1 = __importDefault(require("../entity/NodeConnection"));
 const Flow_1 = __importDefault(require("../entity/Flow"));
 const FlowInstance_1 = __importDefault(require("../entity/FlowInstance"));
 const Node_2 = __importDefault(require("./Node"));
+const flowFilter_1 = require("../helpers/flowFilter");
 const axios_1 = __importDefault(require("axios"));
 //import {configFacebookStrategy} from "./passport-facebook";
+const FlowNdApiDocs_1 = require("../helpers/FlowNdApiDocs");
 let Flow = class Flow extends core_1.Controller {
     async get(params) {
+        const fid = Number(params.flowId);
+        if (!Number.isInteger(fid) || fid < 1) {
+            throw new core_1.PxpError(400, 'flowId is required and must be a positive integer');
+        }
         const nodes = await Node_1.default.find({ flowId: params.flowId });
         const restNodes = [];
         for (let node of nodes) {
@@ -186,14 +193,10 @@ let Flow = class Flow extends core_1.Controller {
             dataFlow.modifiedBy = this.user.username;
             const updFlow = await (0, core_1.__)(manager.save(dataFlow));
             if (updFlow) {
-                let flowInstance = `UPDATE twf_flow_instance SET
-            is_active = 'N' WHERE flow_id = ${updFlow.flowId}`;
-                await manager.query(flowInstance);
+                await manager.query(`UPDATE twf_flow_instance SET is_active = 'N' WHERE flow_id = ?`, [updFlow.flowId]);
                 const nodesToInact = await manager.find(Node_1.default, { flowId: updFlow.flowId, isActive: true });
                 if (nodesToInact.length > 0) {
-                    let flowNode = `UPDATE twf_node SET
-            is_active = 'N' WHERE flow_id = ${updFlow.flowId}`;
-                    await manager.query(flowNode);
+                    await manager.query(`UPDATE twf_node SET is_active = 'N' WHERE flow_id = ?`, [updFlow.flowId]);
                     const nodesToInact = await manager.find(Node_1.default, { flowId: updFlow.flowId });
                     const originalNodeIds = nodesToInact.map((node) => node.nodeId);
                     const connectionsToInact = await manager.find(NodeConnection_1.default, {
@@ -201,9 +204,7 @@ let Flow = class Flow extends core_1.Controller {
                     });
                     const originalNodeCIds = connectionsToInact.map((node) => node.nodeConnectionId);
                     if (originalNodeCIds.length > 0) {
-                        let flowNodeC = `UPDATE twf_node_connection SET
-            is_active = 'N' WHERE node_connection_id in ( ${originalNodeCIds})`;
-                        await manager.query(flowNodeC);
+                        await manager.query(`UPDATE twf_node_connection SET is_active = 'N' WHERE node_connection_id IN (?)`, [originalNodeCIds]);
                     }
                 }
                 return { success: true };
@@ -322,9 +323,9 @@ let Flow = class Flow extends core_1.Controller {
                         });
                         if (connectionsToDel) {
                             const originalNodeCIds = connectionsToDel.map((node) => node.nodeConnectionId);
-                            let flowNodeC = await manager.query(`DELETE
-                                                       from twf_node_connection
-                                                       WHERE node_connection_id = ${originalNodeCIds}`);
+                            if (originalNodeCIds.length > 0) {
+                                await manager.query(`DELETE FROM twf_node_connection WHERE node_connection_id IN (?)`, [originalNodeCIds]);
+                            }
                         }
                     }
                 }
@@ -343,9 +344,9 @@ let Flow = class Flow extends core_1.Controller {
                     allowModify = true;
                     //If there are some nodes in node_connections after delete all records sent, to inactive node
                     let connectNoDel = await (0, typeorm_1.getManager)().query(`SELECT n.node_id
-                                                    from twf_node_connection nd
-                                                           inner join twf_node n on n.node_id = nd.node_id_child
-                                                    WHERE n.node_id = ${nodeDelId}`);
+                 FROM twf_node_connection nd
+                 INNER JOIN twf_node n ON n.node_id = nd.node_id_child
+                 WHERE n.node_id = ?`, [nodeDelId]);
                     const currentNodesIds = connectNoDel.map((record) => record.node_id);
                     // Get nodes to remove
                     const nodesToRemove = currentNodesIds.filter((nodeId) => !taskIds.includes(nodeId.toString()));
@@ -353,10 +354,7 @@ let Flow = class Flow extends core_1.Controller {
                     if (nodesToRemove.length > 0) {
                         const delNodeConnect = await manager.delete(NodeConnection_1.default, { nodeIdChild: nodesToRemove[0] });
                         if (delNodeConnect) {
-                            let dNode = `UPDATE twf_node
-                        SET is_active = 'N'
-                        WHERE node_id = ${nodesToRemove[0]}`;
-                            await manager.query(dNode);
+                            await manager.query(`UPDATE twf_node SET is_active = 'N' WHERE node_id = ?`, [nodesToRemove[0]]);
                         }
                     }
                     if (flowIdDel.action.actionType.name === 'CHAINED FLOW') {
@@ -477,6 +475,10 @@ let Flow = class Flow extends core_1.Controller {
     }
     async getFlowRender(params) {
         var _a;
+        const fid = Number(params.flowId);
+        if (!Number.isInteger(fid) || fid < 1) {
+            throw new core_1.PxpError(400, 'flowId is required and must be a positive integer');
+        }
         const flow = await (0, typeorm_1.getManager)().findOne(Flow_1.default, params.flowId);
         const totalNodes = await (0, typeorm_1.getManager)()
             .createQueryBuilder(Node_1.default, "n")
@@ -782,6 +784,15 @@ let Flow = class Flow extends core_1.Controller {
         const filter = (params === null || params === void 0 ? void 0 : params.filter) ? JSON.parse(params === null || params === void 0 ? void 0 : params.filter) : null;
         const filters = (filter === null || filter === void 0 ? void 0 : filter.items) || [];
         const logicOperator = ((_a = filter === null || filter === void 0 ? void 0 : filter.logicOperator) === null || _a === void 0 ? void 0 : _a.toUpperCase()) || 'AND';
+        const allowedSort = ['flowId', 'name', 'createdAt', 'modifiedAt'];
+        const allowedDir = ['ASC', 'DESC'];
+        const sortCol = params.sort != null && params.sort !== '' ? String(params.sort) : 'flowId';
+        const dirVal = params.dir != null && params.dir !== ''
+            ? String(params.dir).toUpperCase()
+            : 'ASC';
+        if (!allowedSort.includes(sortCol) || !allowedDir.includes(dirVal)) {
+            throw new core_1.PxpError(400, 'sort and dir must be allowed values (whitelist for SQL orderBy)');
+        }
         const queryBuilder = await (0, typeorm_1.getManager)()
             .createQueryBuilder()
             .select([
@@ -823,7 +834,7 @@ let Flow = class Flow extends core_1.Controller {
         const applyDynamicFilters = (queryBuilder, filters, logicOperator) => {
             filters.forEach((filter, index) => {
                 const { field, operator, value } = filter;
-                const queryField = `f.${field}`;
+                const queryField = `f.${(0, flowFilter_1.flowFilterColumn)(field)}`;
                 const parameterName = `filterValue${index}`;
                 let condition;
                 switch (operator) {
@@ -888,7 +899,7 @@ let Flow = class Flow extends core_1.Controller {
         // Sorting and pagination
         //queryBuilder.orderBy(`f.${params.sort}`, params.dir).skip(params.start).take(params.limit);
         // Sorting and pagination
-        queryBuilder.orderBy(`f.${params.sort}`, params.dir);
+        queryBuilder.orderBy(`f.${sortCol}`, dirVal);
         // Agrega manualmente la cláusula LIMIT y OFFSET
         queryBuilder.limit(params.limit).offset(params.start);
         const data = await queryBuilder.getRawMany();
@@ -929,6 +940,15 @@ let Flow = class Flow extends core_1.Controller {
         const filters = (filter === null || filter === void 0 ? void 0 : filter.items) || [];
         const logicOperator = ((_a = filter === null || filter === void 0 ? void 0 : filter.logicOperator) === null || _a === void 0 ? void 0 : _a.toUpperCase()) || "AND";
         const publish = params._publish;
+        const allowedSort = ["flowId", "name", "createdAt", "modifiedAt"];
+        const allowedDir = ["ASC", "DESC"];
+        const sortCol = params.sort != null && params.sort !== "" ? String(params.sort) : "flowId";
+        const dirVal = params.dir != null && params.dir !== ""
+            ? String(params.dir).toUpperCase()
+            : "ASC";
+        if (!allowedSort.includes(sortCol) || !allowedDir.includes(dirVal)) {
+            throw new core_1.PxpError(400, "sort and dir must be allowed values (whitelist for SQL orderBy)");
+        }
         const queryBuilder = await (0, typeorm_1.getManager)()
             .createQueryBuilder()
             .select([
@@ -978,7 +998,7 @@ let Flow = class Flow extends core_1.Controller {
         const applyDynamicFilters = (queryBuilder, filters, logicOperator) => {
             filters.forEach((filter, index) => {
                 const { field, operator, value } = filter;
-                const queryField = `f.${field}`;
+                const queryField = `f.${(0, flowFilter_1.flowFilterColumn)(field)}`;
                 const parameterName = `filterValue${index}`;
                 let condition;
                 switch (operator) {
@@ -1040,7 +1060,7 @@ let Flow = class Flow extends core_1.Controller {
             "f.status",
         ]);
         // Ordenamiento y paginación
-        queryBuilder.orderBy(`f.${params.sort || "flowId"}`, params.dir || "ASC");
+        queryBuilder.orderBy(`f.${sortCol}`, dirVal);
         queryBuilder.limit(params.limit || 50).offset(params.start || 0);
         // Obtener los datos
         const data = await queryBuilder.getRawMany();
@@ -1117,6 +1137,7 @@ __decorate([
     (0, core_1.DbSettings)('Orm'),
     (0, core_1.ReadOnly)(true),
     (0, core_1.Log)(true),
+    (0, core_1.ApiDoc)(FlowNdApiDocs_1.flowGetDoc),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object]),
     __metadata("design:returntype", Promise)
@@ -1135,6 +1156,7 @@ __decorate([
     (0, core_1.DbSettings)('Orm'),
     (0, core_1.ReadOnly)(false),
     (0, core_1.Log)(true),
+    (0, core_1.ApiDoc)(FlowNdApiDocs_1.flowDeleteFlowDoc),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, typeorm_1.EntityManager]),
     __metadata("design:returntype", Promise)
@@ -1144,6 +1166,7 @@ __decorate([
     (0, core_1.DbSettings)('Orm'),
     (0, core_1.ReadOnly)(false),
     (0, core_1.Log)(true),
+    (0, core_1.ApiDoc)(FlowNdApiDocs_1.flowSaveFlowNameDoc),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, typeorm_1.EntityManager]),
     __metadata("design:returntype", Promise)
@@ -1162,6 +1185,7 @@ __decorate([
     (0, core_1.DbSettings)('Orm'),
     (0, core_1.ReadOnly)(false),
     (0, core_1.Log)(true),
+    (0, core_1.ApiDoc)(FlowNdApiDocs_1.flowSaveFlowDoc),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, typeorm_1.EntityManager]),
     __metadata("design:returntype", Promise)
@@ -1172,6 +1196,7 @@ __decorate([
     (0, core_1.DbSettings)('Orm'),
     (0, core_1.ReadOnly)(true),
     (0, core_1.Log)(true),
+    (0, core_1.ApiDoc)(FlowNdApiDocs_1.flowGetFlowRenderDoc),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object]),
     __metadata("design:returntype", Promise)
@@ -1181,6 +1206,7 @@ __decorate([
     (0, core_1.DbSettings)('Orm'),
     (0, core_1.ReadOnly)(false),
     (0, core_1.Log)(true),
+    (0, core_1.ApiDoc)(FlowNdApiDocs_1.flowInsertEventFlowDoc),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, typeorm_1.EntityManager]),
     __metadata("design:returntype", Promise)
@@ -1199,6 +1225,7 @@ __decorate([
     (0, core_1.DbSettings)('Orm'),
     (0, core_1.ReadOnly)(false),
     (0, core_1.Log)(true),
+    (0, core_1.ApiDoc)(FlowNdApiDocs_1.flowChangeStatusFlowDoc),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, typeorm_1.EntityManager]),
     __metadata("design:returntype", Promise)
@@ -1217,6 +1244,7 @@ __decorate([
     (0, core_1.DbSettings)("Orm"),
     (0, core_1.ReadOnly)(true),
     (0, core_1.Log)(true),
+    (0, core_1.ApiDoc)(FlowNdApiDocs_1.flowListTemplatesDoc),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object]),
     __metadata("design:returntype", Promise)
@@ -1231,6 +1259,7 @@ __decorate([
     __metadata("design:returntype", Promise)
 ], Flow.prototype, "changePublishTemplate", null);
 Flow = __decorate([
+    (0, core_1.ApiDocFor)('add', FlowNdApiDocs_1.flowAddDoc),
     (0, core_1.Model)('flow-nd/Flow')
 ], Flow);
 exports.default = Flow;

package/dist/controllers/FlowInstance.js

@@ -41,6 +41,7 @@ const Flow_1 = __importDefault(require("../entity/Flow"));
 const Action_1 = __importDefault(require("../entity/Action"));
 const FlowLog_1 = __importDefault(require("../entity/FlowLog"));
 const dbLock_1 = require("../helpers/dbLock");
+const sqlIdent_1 = require("../helpers/sqlIdent");
 class FlowInstance extends core_1.Controller {
     async processPending(params, manager) {
         let flowInstanceIdProcessing = -1;
@@ -89,8 +90,7 @@ class FlowInstance extends core_1.Controller {
                 for (const n of node) {
                     //get data of view
                     const { action: { originName, originKey }, } = n;
-                    const executeView = `select * from ${originName} where ${originKey} = ${newEvent.dataId}`;
-                    const resExecuteView = await (0, typeorm_1.getManager)().query(executeView);
+                    const resExecuteView = await (0, sqlIdent_1.selectByIdent)((0, typeorm_1.getManager)(), originName, originKey, newEvent.dataId);
                     const flow = await (0, core_1.__)(Flow_1.default.findOne({ where: { flowId: n.flowId, isActive: 1, status: 'on' } }));
                     if (flow && flow.vendorId == resExecuteView[0].vendor_id &&
                         (await this.checkConditions(resExecuteView[0], n.flowId, newEvent.actionId))) {

package/dist/controllers/Node.d.ts

@@ -10,6 +10,7 @@
  * 04-Sep-2023    SP08SEP23     Rensi Arteaga           add modifiedAt for flows
  * 29-Sep-2023    SP06OCT23     Mercedes Zambrana       Add validation when flow is on
  * 19-Jan-2025    8201489097    Favio Figueroa          Add Controller Validation
+ * 06-Nov-2026                     Rensi Arteaga         @ApiDoc for OpenAPI (spec 04)
  * ******************************************************************************
  */
 import { EntityManager } from 'typeorm';

package/dist/controllers/Node.js

@@ -11,6 +11,7 @@
  * 04-Sep-2023    SP08SEP23     Rensi Arteaga           add modifiedAt for flows
  * 29-Sep-2023    SP06OCT23     Mercedes Zambrana       Add validation when flow is on
  * 19-Jan-2025    8201489097    Favio Figueroa          Add Controller Validation
+ * 06-Nov-2026                     Rensi Arteaga         @ApiDoc for OpenAPI (spec 04)
  * ******************************************************************************
  */
 var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
@@ -35,11 +36,13 @@ const FieldMap_1 = __importDefault(require("../entity/FieldMap"));
 const OriginName_1 = __importDefault(require("../entity/OriginName"));
 const axios_1 = __importDefault(require("axios"));
 const Flow_1 = __importDefault(require("../entity/Flow"));
+const FlowNdApiDocs_1 = require("../helpers/FlowNdApiDocs");
+const sqlIdent_1 = require("../helpers/sqlIdent");
+const sessionVendor_1 = require("../helpers/sessionVendor");
 let Node = class Node extends core_1.Controller {
     async getNodeData(node, dataId, manager) {
         const { action: { originName, originKey } } = node;
-        const executeView = `select * from ${originName} where ${originKey} = ${dataId}`;
-        const resExecuteView = await (0, core_1.__)(manager.query(executeView));
+        const resExecuteView = await (0, core_1.__)((0, sqlIdent_1.selectByIdent)(manager, originName, originKey, dataId));
         return JSON.stringify(resExecuteView[0]);
     }
     async add(params, manager) {
@@ -113,7 +116,18 @@ let Node = class Node extends core_1.Controller {
     }
     async getParameterizedNode(params, manager) {
         lodash_1.default.templateSettings.interpolate = /{{([\s\S]+?)}}/g;
-        const { nodeId, flowId, substitutionsSchemaJson = {} } = params;
+        const nid = Number(params.nodeId);
+        if (!Number.isInteger(nid) || nid < 1) {
+            throw new core_1.PxpError(400, 'nodeId is required and must be a positive integer');
+        }
+        const { nodeId, flowId } = params;
+        const requestedSubstitutions = params.substitutionsSchemaJson && typeof params.substitutionsSchemaJson === 'object'
+            ? { ...params.substitutionsSchemaJson }
+            : {};
+        const sessionVendor = (0, sessionVendor_1.harmonyVendorId)(this.user);
+        const substitutionsSchemaJson = sessionVendor != null
+            ? { ...requestedSubstitutions, vendorId: sessionVendor }
+            : requestedSubstitutions;
         const tNodeData = (0, core_1.__)(Node_1.default.findOne(nodeId));
         const nodeData = await tNodeData;
         const tNodeOrigin = await (0, core_1.__)(Node_1.default.findOne({
@@ -255,17 +269,15 @@ let Node = class Node extends core_1.Controller {
         };
     }
     async executeActionJson(params, manager) {
-        const { nodeId, originName, originKey, fromValues } = params;
-        // we need to get the value from merge values with originKey
+        const { nodeId, fromValues } = params;
+        const nodeRow = await (0, core_1.__)(Node_1.default.findOne({ where: { nodeId }, relations: ['action'] }));
+        if (!nodeRow || !nodeRow.action) {
+            throw new core_1.PxpError(400, 'Invalid origin');
+        }
         const getParameterizedNodeData = await (0, core_1.__)(this.getParameterizedNode({ nodeId: nodeId }, manager));
         const { mergeValues } = getParameterizedNodeData;
-        const findOriginValue = Object.entries(mergeValues).find(([nameValue]) => fromValues === nameValue);
-        const resValueObject = Object.fromEntries([findOriginValue]);
-        const originValue = resValueObject[fromValues];
-        const executeViewString = `select * from ${originName} where ${originKey} = ${originValue}`;
-        const resExecuteView = await (0, typeorm_1.getManager)().query(executeViewString);
-        /*const executeView = `select * from ${originName} where ${originKey} = ${newEvent.dataId}`;
-        const resExecuteView = await getManager().query(executeView);*/
+        const originValue = mergeValues ? mergeValues[fromValues] : undefined;
+        const resExecuteView = await (0, sqlIdent_1.selectByIdent)((0, typeorm_1.getManager)(), nodeRow.action.originName, nodeRow.action.originKey, originValue);
         return {
             ...resExecuteView[0]
         };
@@ -298,6 +310,7 @@ __decorate([
     (0, core_1.DbSettings)('Orm'),
     (0, core_1.ReadOnly)(false),
     (0, core_1.Log)(true),
+    (0, core_1.ApiDoc)(FlowNdApiDocs_1.nodeAddDoc),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, typeorm_1.EntityManager]),
     __metadata("design:returntype", Promise)
@@ -307,6 +320,7 @@ __decorate([
     (0, core_1.DbSettings)('Orm'),
     (0, core_1.ReadOnly)(false),
     (0, core_1.Log)(true),
+    (0, core_1.ApiDoc)(FlowNdApiDocs_1.nodeAddActionConfigJsonDoc),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, typeorm_1.EntityManager]),
     __metadata("design:returntype", Promise)
@@ -316,6 +330,7 @@ __decorate([
     (0, core_1.DbSettings)('Orm'),
     (0, core_1.ReadOnly)(false),
     (0, core_1.Log)(true),
+    (0, core_1.ApiDoc)(FlowNdApiDocs_1.nodeGetParameterizedNodeDoc),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, typeorm_1.EntityManager]),
     __metadata("design:returntype", Promise)

package/dist/controllers/NodeInstance.js

@@ -42,18 +42,20 @@ const Action_1 = __importDefault(require("../entity/Action"));
 const lodash_1 = __importDefault(require("lodash"));
 const FlowInstance_1 = __importDefault(require("../entity/FlowInstance"));
 const dbLock_1 = require("../helpers/dbLock");
+const sqlIdent_1 = require("../helpers/sqlIdent");
 //TODO replace this flow-nd need tobe independent library
 const common_1 = require("@pxp-nd/common");
 let NodeInstance = class NodeInstance extends core_1.Controller {
     async RecursiveInstance(params, manager) {
-        var _a;
+        var _a, _b, _c, _d, _e;
         //https://lodash.com/docs/4.17.15#template
         lodash_1.default.templateSettings.interpolate = /{{([\s\S]+?)}}/g;
         //todo after this we need to get the json variables and execute the view and conditions configured in the database
         const { node, flowInstance, eventNode } = params;
         try {
-            const executeView = `select * from ${flowInstance.originName} where ${flowInstance.originKey} = ${flowInstance.dataId}`;
-            const resExecuteView = await (0, core_1.__)((0, typeorm_1.getManager)().query(executeView));
+            const originName = (_b = (_a = node === null || node === void 0 ? void 0 : node.action) === null || _a === void 0 ? void 0 : _a.originName) !== null && _b !== void 0 ? _b : flowInstance.originName;
+            const originKey = (_d = (_c = node === null || node === void 0 ? void 0 : node.action) === null || _c === void 0 ? void 0 : _c.originKey) !== null && _d !== void 0 ? _d : flowInstance.originKey;
+            const resExecuteView = await (0, core_1.__)((0, sqlIdent_1.selectByIdent)((0, typeorm_1.getManager)(), originName, originKey, flowInstance.dataId));
             const resultFromOrigin = resExecuteView[0];
             //let mergeJson = {};
             let mergeJson = {};
@@ -94,7 +96,7 @@ let NodeInstance = class NodeInstance extends core_1.Controller {
                     if (nodeInstanceId) {
                         mergeJson.nodeInstanceId = nodeInstanceId;
                     }
-                    if (!!((_a = node === null || node === void 0 ? void 0 : node.action) === null || _a === void 0 ? void 0 : _a.controllerFunction)) {
+                    if (!!((_e = node === null || node === void 0 ? void 0 : node.action) === null || _e === void 0 ? void 0 : _e.controllerFunction)) {
                         const config = {
                             method: "post",
                             url: `http://localhost:${process.env.PORT}/api/${node.action.controllerFunction}`,

package/dist/helpers/FlowNdApiDocs.d.ts

@@ -0,0 +1,19 @@
+/**
+ * @pxp-nd/flow — OpenAPI (@ApiDoc) payloads for flow-nd controllers (spec tempo-04).
+ * Vendor is session-scoped; do not document vendorId / _vendorId as inputs.
+ */
+import { ApiDocSpec } from '@pxp-nd/core';
+export declare const flowListTemplatesDoc: ApiDocSpec;
+export declare const flowGetDoc: ApiDocSpec;
+export declare const flowGetFlowRenderDoc: ApiDocSpec;
+export declare const flowAddDoc: ApiDocSpec;
+export declare const flowSaveFlowDoc: ApiDocSpec;
+export declare const flowSaveFlowNameDoc: ApiDocSpec;
+export declare const flowInsertEventFlowDoc: ApiDocSpec;
+export declare const flowChangeStatusFlowDoc: ApiDocSpec;
+export declare const flowDeleteFlowDoc: ApiDocSpec;
+export declare const nodeAddDoc: ApiDocSpec;
+export declare const nodeAddActionConfigJsonDoc: ApiDocSpec;
+export declare const nodeGetParameterizedNodeDoc: ApiDocSpec;
+export declare const actionGetActionsDoc: ApiDocSpec;
+export declare const actionGetFieldMapByActionDoc: ApiDocSpec;

package/dist/helpers/FlowNdApiDocs.js

@@ -0,0 +1,299 @@
+"use strict";
+/**
+ * @pxp-nd/flow — OpenAPI (@ApiDoc) payloads for flow-nd controllers (spec tempo-04).
+ * Vendor is session-scoped; do not document vendorId / _vendorId as inputs.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.actionGetFieldMapByActionDoc = exports.actionGetActionsDoc = exports.nodeGetParameterizedNodeDoc = exports.nodeAddActionConfigJsonDoc = exports.nodeAddDoc = exports.flowDeleteFlowDoc = exports.flowChangeStatusFlowDoc = exports.flowInsertEventFlowDoc = exports.flowSaveFlowNameDoc = exports.flowSaveFlowDoc = exports.flowAddDoc = exports.flowGetFlowRenderDoc = exports.flowGetDoc = exports.flowListTemplatesDoc = void 0;
+exports.flowListTemplatesDoc = {
+    operationId: 'flow-nd.Flow.listTemplates',
+    summary: 'List templates',
+    description: 'Lists templates the session vendor can use: its own and the shared ones. Returns { data, count }. Defaults: _type \'template\', sort \'flowId\', dir \'ASC\', limit 50.',
+    params: {
+        type: 'object',
+        properties: {
+            _templateType: { type: 'string', enum: ['flow', 'funnel'] },
+            _type: { type: 'string', enum: ['template'] },
+            _publish: { type: 'string', enum: ['Y', 'N'], description: 'Y = only published templates.' },
+            _isActive: { type: 'integer', enum: [0, 1] },
+            genericFilterFields: { type: 'string', enum: ['name', 'description'] },
+            genericFilterValue: { type: 'string' },
+            filter: { type: 'string', description: 'JSON string { items, logicOperator }, as for the flow list.' },
+            start: { type: 'integer', minimum: 0 },
+            limit: { type: 'integer', minimum: 1 },
+            sort: { type: 'string', enum: ['flowId', 'name', 'createdAt', 'modifiedAt'] },
+            dir: { type: 'string', enum: ['ASC', 'DESC'] },
+        },
+        additionalProperties: false,
+    },
+    readOnly: true,
+    permission: null,
+};
+exports.flowGetDoc = {
+    operationId: 'flow-nd.Flow.get',
+    summary: 'Nodes of a flow',
+    description: 'Returns the nodes of one flow as an array of { node, connections }: connections are the IDs of child nodes, node.valuesForShowingInNode holds the main configured values.',
+    params: {
+        type: 'object',
+        properties: { flowId: { type: 'integer', minimum: 1 } },
+        required: ['flowId'],
+        additionalProperties: false,
+    },
+    readOnly: true,
+    permission: null,
+};
+exports.flowGetFlowRenderDoc = {
+    operationId: 'flow-nd.Flow.getFlowRender',
+    summary: 'Editor board of a flow',
+    description: 'Returns { flow, board } as used by the flow editor. board.columns[\'2-column-nodes-configured\'].taskIds is the current node order (\'node-<nodeId>\'); board.columns[\'1-column-config-nodes\'].taskIds are the steps that can be added next. Same behaviour for GET and POST.',
+    params: {
+        type: 'object',
+        properties: { flowId: { type: 'integer', minimum: 1 } },
+        required: ['flowId'],
+        additionalProperties: false,
+    },
+    readOnly: true,
+    permission: null,
+};
+exports.flowAddDoc = {
+    operationId: 'flow-nd.Flow.add',
+    summary: 'Create a flow',
+    description: 'Creates a flow for the session vendor. This is the default create route of the Flow model: it saves the fields it receives. Returns the saved flow row, including flowId.',
+    params: {
+        type: 'object',
+        properties: {
+            name: { type: 'string', minLength: 1, maxLength: 255 },
+            description: { type: 'string' },
+            templateType: { type: 'string', enum: ['flow', 'funnel'] },
+            type: { type: 'string', enum: ['custom', 'template'] },
+            status: { type: 'string', enum: ['off', 'on'] },
+        },
+        required: ['name', 'templateType', 'type'],
+        additionalProperties: false,
+    },
+    readOnly: false,
+    permission: null,
+};
+exports.flowSaveFlowDoc = {
+    operationId: 'flow-nd.Flow.saveFlow',
+    summary: 'Add or remove a step',
+    description: 'Adds or removes a step in a flow, as the flow editor does. The flow must be off, otherwise 400 \'Please turn off the flow before make a change\'. To add a step (origin \'cloneTask\'): taskIds is the full new order with \'new\' at the position of the new step, and tasks.new holds the flow ID and the action code. To remove a step (origin \'deleteTask\'): taskIds is the order without that node and deleteId is its ID. Other keys of tasks are ignored. Returns { success: true, nodeId } (the new node ID, or null).',
+    params: {
+        type: 'object',
+        properties: {
+            board: {
+                type: 'object',
+                properties: {
+                    origin: { type: 'string', enum: ['cloneTask', 'deleteTask'] },
+                    deleteId: { type: 'string', pattern: '^node-[0-9]+$', description: 'Only for deleteTask.' },
+                    columns: {
+                        type: 'object',
+                        properties: {
+                            '2-column-nodes-configured': {
+                                type: 'object',
+                                properties: {
+                                    taskIds: {
+                                        type: 'array',
+                                        items: { type: 'string', pattern: '^(new|node-[0-9]+)$' },
+                                        description: 'Node order. Existing nodes are \'node-<nodeId>\'; for cloneTask \'new\' once.',
+                                    },
+                                },
+                                required: ['taskIds'],
+                            },
+                        },
+                        required: ['2-column-nodes-configured'],
+                    },
+                    tasks: {
+                        type: 'object',
+                        properties: {
+                            new: {
+                                type: 'object',
+                                properties: {
+                                    flowId: { type: 'integer', minimum: 1 },
+                                    action: {
+                                        type: 'object',
+                                        properties: { code: { type: 'string', description: 'Action code from Action/getActions.' } },
+                                        required: ['code'],
+                                    },
+                                },
+                                required: ['flowId', 'action'],
+                            },
+                        },
+                    },
+                },
+                required: ['origin', 'columns'],
+            },
+        },
+        required: ['board'],
+        additionalProperties: false,
+    },
+    readOnly: false,
+    permission: null,
+};
+exports.flowSaveFlowNameDoc = {
+    operationId: 'flow-nd.Flow.saveFlowName',
+    summary: 'Rename a flow',
+    description: 'Renames a flow. The flow must be off (400 otherwise). For a template it also saves code, description, icon and flowType. Returns { success: true } or { success: false }.',
+    params: {
+        type: 'object',
+        properties: {
+            flowId: { type: 'integer', minimum: 1 },
+            name: { type: 'string', minLength: 1, maxLength: 255 },
+            code: { type: 'string', description: 'Templates only.' },
+            description: { type: 'string', description: 'Templates only.' },
+            icon: { type: 'string', description: 'Templates only.' },
+            flowType: { type: 'string', description: 'Templates only.' },
+        },
+        required: ['flowId', 'name'],
+        additionalProperties: false,
+    },
+    readOnly: false,
+    permission: null,
+};
+exports.flowInsertEventFlowDoc = {
+    operationId: 'flow-nd.Flow.insertEventFlow',
+    summary: 'Add the trigger of a flow',
+    description: 'Creates the first node (isInit = \'Y\') of a flow from an EVENT action. Returns { success: true, nodeId } or { success: false, msg }.',
+    params: {
+        type: 'object',
+        properties: {
+            flowId: { type: 'integer', minimum: 1 },
+            actionId: { type: 'integer', minimum: 1, description: 'An active EVENT action (Action/getActions with actionTypeName \'EVENT\').' },
+        },
+        required: ['flowId', 'actionId'],
+        additionalProperties: false,
+    },
+    readOnly: false,
+    permission: null,
+};
+exports.flowChangeStatusFlowDoc = {
+    operationId: 'flow-nd.Flow.changeStatusFlow',
+    summary: 'Turn a flow on or off',
+    description: 'Toggles the flow status between \'off\' and \'on\'. A flow that is on runs for real contacts (sends emails and messages). Turning on needs at least 2 active steps (400 otherwise). Returns { success: true } or { success: false }.',
+    params: {
+        type: 'object',
+        properties: { flowId: { type: 'integer', minimum: 1 } },
+        required: ['flowId'],
+        additionalProperties: false,
+    },
+    readOnly: false,
+    permission: null,
+};
+exports.flowDeleteFlowDoc = {
+    operationId: 'flow-nd.Flow.deleteFlow',
+    summary: 'Delete a flow',
+    description: 'Soft-deletes a flow: the flow, its instances, nodes and connections become inactive. The flow must be off (400 otherwise). Returns { success: true } or { success: false }.',
+    params: {
+        type: 'object',
+        properties: { flowId: { type: 'integer', minimum: 1 } },
+        required: ['flowId'],
+        additionalProperties: false,
+    },
+    readOnly: false,
+    permission: null,
+};
+exports.nodeAddDoc = {
+    operationId: 'flow-nd.Node.add',
+    summary: 'Create a node with parent connections',
+    description: 'Creates a node in a flow. For each parent, the parent\'s existing child connections are moved to the new node and a connection parent → new node is added. Every parentId must be a node of the same flow. The flow editor uses Flow/saveFlow instead. Returns the saved node row, including nodeId.',
+    params: {
+        type: 'object',
+        properties: {
+            flowId: { type: 'integer', minimum: 1 },
+            actionId: { type: 'integer', minimum: 1 },
+            isInit: { type: 'string', enum: ['Y', 'N'] },
+            isEnd: { type: 'string', enum: ['Y', 'N'] },
+            parents: {
+                type: 'array',
+                items: {
+                    type: 'object',
+                    properties: {
+                        parentId: { type: 'integer', minimum: 1 },
+                        condition: { type: 'string' },
+                    },
+                    required: ['parentId'],
+                    additionalProperties: false,
+                },
+            },
+        },
+        required: ['flowId', 'actionId', 'isInit', 'isEnd'],
+        additionalProperties: false,
+    },
+    readOnly: false,
+    permission: null,
+};
+exports.nodeAddActionConfigJsonDoc = {
+    operationId: 'flow-nd.Node.AddActionConfigJson',
+    summary: 'Save the configuration of a step',
+    description: 'Saves the configuration of one node. The flow must be off (400 otherwise). The step fields are sent as top-level keys next to nodeId. __metadata maps a field name to { name } for fields that hold a merge variable; such a field is stored as \'{{ <name> }}\'. The step\'s validation controller runs before saving. Returns { actionConfigJson, success: true, nodeId, msg }.',
+    params: {
+        type: 'object',
+        properties: {
+            nodeId: { type: 'integer', minimum: 1 },
+            __metadata: {
+                type: 'object',
+                additionalProperties: {
+                    type: 'object',
+                    properties: { name: { type: 'string' } },
+                    required: ['name'],
+                },
+            },
+        },
+        required: ['nodeId', '__metadata'],
+        additionalProperties: true,
+    },
+    readOnly: false,
+    permission: null,
+};
+exports.nodeGetParameterizedNodeDoc = {
+    operationId: 'flow-nd.Node.getParameterizedNode',
+    summary: 'Step with its field schema',
+    description: 'Returns a node with what is needed to configure it: the node, its merged current values, schemaJsonObject (the field schema of the step, with substitutions applied) and the merge fields available from the trigger of the flow. Does not change data.',
+    params: {
+        type: 'object',
+        properties: {
+            nodeId: { type: 'integer', minimum: 1 },
+            substitutionsSchemaJson: {
+                type: 'object',
+                description: 'Values substituted into the step\'s schema template.',
+                properties: {
+                    locationId: { type: 'integer', minimum: 1 },
+                    keyword: { type: 'string' },
+                },
+                additionalProperties: false,
+            },
+        },
+        required: ['nodeId'],
+        additionalProperties: false,
+    },
+    readOnly: true,
+    permission: null,
+};
+exports.actionGetActionsDoc = {
+    operationId: 'flow-nd.Action.getActions',
+    summary: 'Catalog of step types',
+    description: 'Returns { data: Action[] }; each action has actionId, code, name, schemaJson (field schema of the step), configJsonTemplate and actionType. Filter by actionTypeName, for example \'EVENT\' for triggers.',
+    params: {
+        type: 'object',
+        properties: {
+            actionTypeName: { type: 'string', description: 'For example EVENT, PAGE, CHAINED FLOW.' },
+            actionId: { type: 'integer', minimum: 1 },
+        },
+        additionalProperties: false,
+    },
+    readOnly: true,
+    permission: null,
+};
+exports.actionGetFieldMapByActionDoc = {
+    operationId: 'flow-nd.Action.getFieldMapByAction',
+    summary: 'Merge fields of an origin',
+    description: 'Returns the field-map rows (merge fields) of an origin, the data source of a trigger (Action.originName).',
+    params: {
+        type: 'object',
+        properties: { originName: { type: 'string', minLength: 1 } },
+        required: ['originName'],
+        additionalProperties: false,
+    },
+    readOnly: true,
+    permission: null,
+};

package/dist/helpers/flowFilter.d.ts

@@ -0,0 +1,13 @@
+/*****************************************************************************
+ * Copyright(c) 2026 Qorus Inc
+ * All rights reserved
+ *****************************************************************************
+ * NAME: flowFilter.ts
+ * DEVELOPER: Rensi Arteaga
+ * DESCRIPTION: Whitelist of flow list filter columns. Client field names are not interpolated.
+ * REVISIONS:
+ * Date Change      ID              Author              Description
+ * -----------      -----------     --------------      ------------------------------------
+ * 10-Nov-2026                      Rensi Arteaga       Created
+ ******************************************************************************/
+export declare function flowFilterColumn(field: unknown): string;

package/dist/helpers/flowFilter.js

@@ -0,0 +1,56 @@
+"use strict";
+/*****************************************************************************
+ * Copyright(c) 2026 Qorus Inc
+ * All rights reserved
+ *****************************************************************************
+ * NAME: flowFilter.ts
+ * DEVELOPER: Rensi Arteaga
+ * DESCRIPTION: Whitelist of flow list filter columns. Client field names are not interpolated.
+ * REVISIONS:
+ * Date Change      ID              Author              Description
+ * -----------      -----------     --------------      ------------------------------------
+ * 10-Nov-2026                      Rensi Arteaga       Created
+ ******************************************************************************/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.flowFilterColumn = void 0;
+const core_1 = require("@pxp-nd/core");
+const FLOW_FILTER_COLUMNS = {
+    flowId: 'flow_id',
+    flow_id: 'flow_id',
+    vendorId: 'vendor_id',
+    vendor_id: 'vendor_id',
+    code: 'code',
+    name: 'name',
+    enabled: 'enabled',
+    type: 'type',
+    createdBy: 'created_by',
+    created_by: 'created_by',
+    modifiedBy: 'modified_by',
+    modified_by: 'modified_by',
+    createdAt: 'created_at',
+    created_at: 'created_at',
+    modifiedAt: 'modified_at',
+    modified_at: 'modified_at',
+    isActive: 'is_active',
+    is_active: 'is_active',
+    description: 'description',
+    icon: 'icon',
+    status: 'status',
+    templateType: 'template_type',
+    template_type: 'template_type',
+    flowType: 'flow_type',
+    flow_type: 'flow_type',
+    publish: 'publish',
+    userIdAi: 'user_id_ai',
+    user_id_ai: 'user_id_ai',
+    userAi: 'user_ai',
+    user_ai: 'user_ai',
+};
+function flowFilterColumn(field) {
+    const column = FLOW_FILTER_COLUMNS[String(field !== null && field !== void 0 ? field : '')];
+    if (!column) {
+        throw new core_1.PxpError(400, 'Invalid filter field');
+    }
+    return column;
+}
+exports.flowFilterColumn = flowFilterColumn;

package/dist/helpers/sessionVendor.d.ts

@@ -0,0 +1,13 @@
+/*****************************************************************************
+ * Copyright(c) 2026 Qorus Inc
+ * All rights reserved
+ *****************************************************************************
+ * NAME: sessionVendor.ts
+ * DEVELOPER: Rensi Arteaga
+ * DESCRIPTION: Session vendor for flow templates. Request vendor is ignored for harmony users.
+ * REVISIONS:
+ * Date Change      ID              Author              Description
+ * -----------      -----------     --------------      ------------------------------------
+ * 10-Nov-2026                      Rensi Arteaga       Created
+ ******************************************************************************/
+export declare function harmonyVendorId(user: any): number | null;

package/dist/helpers/sessionVendor.js

@@ -0,0 +1,28 @@
+"use strict";
+/*****************************************************************************
+ * Copyright(c) 2026 Qorus Inc
+ * All rights reserved
+ *****************************************************************************
+ * NAME: sessionVendor.ts
+ * DEVELOPER: Rensi Arteaga
+ * DESCRIPTION: Session vendor for flow templates. Request vendor is ignored for harmony users.
+ * REVISIONS:
+ * Date Change      ID              Author              Description
+ * -----------      -----------     --------------      ------------------------------------
+ * 10-Nov-2026                      Rensi Arteaga       Created
+ ******************************************************************************/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.harmonyVendorId = void 0;
+function harmonyVendorId(user) {
+    var _a;
+    const raw = (_a = user === null || user === void 0 ? void 0 : user.harmony) === null || _a === void 0 ? void 0 : _a.vendor_id;
+    if (raw == null || raw === '') {
+        return null;
+    }
+    const id = Number(raw);
+    if (!Number.isInteger(id) || id <= 0) {
+        return null;
+    }
+    return id;
+}
+exports.harmonyVendorId = harmonyVendorId;

package/dist/helpers/sqlIdent.d.ts

@@ -0,0 +1,17 @@
+/*****************************************************************************
+ * Copyright(c) 2026 Qorus Inc
+ * All rights reserved
+ *****************************************************************************
+ * NAME: sqlIdent.ts
+ * DEVELOPER: Rensi Arteaga
+ * DESCRIPTION: Parameterized origin queries. Identifiers are checked, values are bound.
+ * REVISIONS:
+ * Date Change      ID              Author              Description
+ * -----------      -----------     --------------      ------------------------------------
+ * 10-Nov-2026                      Rensi Arteaga       Created
+ ******************************************************************************/
+export declare function sqlIdent(value: unknown): string;
+export declare function quoteIdent(value: unknown): string;
+export declare function selectByIdent(manager: {
+    query: (sql: string, params?: unknown[]) => Promise<any>;
+}, originName: unknown, originKey: unknown, value: unknown): Promise<any[]>;

package/dist/helpers/sqlIdent.js

@@ -0,0 +1,34 @@
+"use strict";
+/*****************************************************************************
+ * Copyright(c) 2026 Qorus Inc
+ * All rights reserved
+ *****************************************************************************
+ * NAME: sqlIdent.ts
+ * DEVELOPER: Rensi Arteaga
+ * DESCRIPTION: Parameterized origin queries. Identifiers are checked, values are bound.
+ * REVISIONS:
+ * Date Change      ID              Author              Description
+ * -----------      -----------     --------------      ------------------------------------
+ * 10-Nov-2026                      Rensi Arteaga       Created
+ ******************************************************************************/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.selectByIdent = exports.quoteIdent = exports.sqlIdent = void 0;
+const core_1 = require("@pxp-nd/core");
+const SQL_IDENT = /^[A-Za-z_][A-Za-z0-9_]*$/;
+function sqlIdent(value) {
+    const ident = String(value !== null && value !== void 0 ? value : '');
+    if (!SQL_IDENT.test(ident)) {
+        throw new core_1.PxpError(400, 'Invalid origin');
+    }
+    return ident;
+}
+exports.sqlIdent = sqlIdent;
+function quoteIdent(value) {
+    return '`' + sqlIdent(value) + '`';
+}
+exports.quoteIdent = quoteIdent;
+async function selectByIdent(manager, originName, originKey, value) {
+    const sql = `SELECT * FROM ${quoteIdent(originName)} WHERE ${quoteIdent(originKey)} = ?`;
+    return manager.query(sql, [value]);
+}
+exports.selectByIdent = selectByIdent;

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@pxp-nd/flow",
-  "version": "1.1.30",
+  "version": "1.1.32",
   "description": "Workflow module for pxp-nd framework",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "prepublish": "tsc",
   "scripts": {
-    "test": "echo \"Error: no test specified\" && exit 1",
+    "test": "jest --runInBand",
     "build": "rimraf ./dist && tsc",
     "dev:publish": "yalc publish",
     "prod:publish": "npm publish",
@@ -24,6 +24,13 @@
   ],
   "author": "Kplian",
   "license": "ISC",
+  "jest": {
+    "preset": "ts-jest",
+    "testEnvironment": "node",
+    "roots": ["<rootDir>/test"],
+    "testTimeout": 30000,
+    "globals": { "ts-jest": { "tsconfig": "<rootDir>/test/tsconfig.json" } }
+  },
   "bugs": {
     "url": "https://github.com/kplian/flow-nd/issues"
   },
@@ -31,13 +38,16 @@
   "devDependencies": {
     "@types/lodash": "^4.14.172",
     "@types/node": "^16.4.13",
+    "@types/jest": "^27.5.2",
+    "jest": "^27.5.1",
+    "ts-jest": "^27.1.5",
     "rimraf": "^3.0.2",
     "tsc-watch": "^4.6.2",
     "typescript": "^4.9.5"
   },
   "dependencies": {
     "@pxp-nd/common": "^1.1.4",
-    "@pxp-nd/core": "^1.1.13",
+    "@pxp-nd/core": "^1.2.96",
     "axios": "^0.21.1",
     "lodash": "^4.17.21",
     "typeorm": "^0.2.36"

package/test/sql-ident.test.ts

@@ -0,0 +1,168 @@
+import 'reflect-metadata';
+import { getManager } from 'typeorm';
+import { PxpError } from '@pxp-nd/core';
+import NodeModel from '../src/entity/Node';
+import NodeInstanceModel from '../src/entity/NodeInstance';
+import Event from '../src/entity/Event';
+import Flow from '../src/entity/Flow';
+import NodeController from '../src/controllers/Node';
+import FlowInstanceController from '../src/controllers/FlowInstance';
+import NodeInstanceController from '../src/controllers/NodeInstance';
+import { flowFilterColumn } from '../src/helpers/flowFilter';
+
+jest.mock('typeorm', () => {
+  const actual = jest.requireActual('typeorm');
+  return {
+    ...actual,
+    getManager: jest.fn(),
+  };
+});
+
+const pxpConfig = { apiPrefix: '/api', defaultDbSettings: 'Orm' as const, middlewares: [] as any[] };
+
+function queryManager() {
+  const query = jest.fn().mockResolvedValue([{ id: 1 }]);
+  const save = jest.fn().mockResolvedValue({});
+  (getManager as unknown as jest.Mock).mockReturnValue({ query, save });
+  return { query, save };
+}
+
+describe('select by identifier', () => {
+  it('binds a stored value and rejects a bad origin before querying', async () => {
+    const ctrl = new NodeController('flow-nd', NodeModel, pxpConfig);
+    const query = jest.fn();
+    await expect(
+      ctrl.getNodeData({ action: { originName: 'bad name', originKey: 'id' } }, 1, { query } as any)
+    ).rejects.toBeInstanceOf(PxpError);
+    expect(query).not.toHaveBeenCalled();
+
+    const ok = jest.fn().mockResolvedValue([{ id: 7 }]);
+    const raw = await ctrl.getNodeData(
+      { action: { originName: 'people', originKey: 'person_id' } },
+      '1 UNION SELECT 1',
+      { query: ok } as any,
+    );
+    expect(ok).toHaveBeenCalledWith(
+      'SELECT * FROM `people` WHERE `person_id` = ?',
+      ['1 UNION SELECT 1'],
+    );
+    expect(raw).toBe(JSON.stringify({ id: 7 }));
+  });
+
+  it('executeActionJson uses the action row, not the request identifiers', async () => {
+    const { query } = queryManager();
+    const ctrl = new NodeController('flow-nd', NodeModel, pxpConfig);
+    jest.spyOn(NodeModel, 'findOne').mockResolvedValue({
+      action: { originName: 'people', originKey: 'person_id' },
+    } as any);
+    jest.spyOn(ctrl, 'getParameterizedNode').mockResolvedValue({
+      mergeValues: { payload: '1 UNION SELECT 1' },
+    } as any);
+
+    await ctrl.executeActionJson(
+      { nodeId: 4, fromValues: 'payload', originName: 'other_table', originKey: 'other_col' },
+      {} as any,
+    );
+
+    expect(query).toHaveBeenCalledWith(
+      'SELECT * FROM `people` WHERE `person_id` = ?',
+      ['1 UNION SELECT 1'],
+    );
+    expect(query.mock.calls[0][0]).not.toContain('UNION');
+  });
+
+  it('executeActionJson rejects an action origin that is not an identifier', async () => {
+    const { query } = queryManager();
+    const ctrl = new NodeController('flow-nd', NodeModel, pxpConfig);
+    jest.spyOn(NodeModel, 'findOne').mockResolvedValue({
+      action: { originName: 'people;drop', originKey: 'id' },
+    } as any);
+    jest.spyOn(ctrl, 'getParameterizedNode').mockResolvedValue({ mergeValues: { payload: '1' } } as any);
+
+    await expect(
+      ctrl.executeActionJson({ nodeId: 4, fromValues: 'payload' }, {} as any)
+    ).rejects.toBeInstanceOf(PxpError);
+    expect(query).not.toHaveBeenCalled();
+  });
+});
+
+describe('event and node instance queries', () => {
+  it('eventProcesss binds dataId', async () => {
+    const { query } = queryManager();
+    jest.spyOn(Event, 'find').mockResolvedValue([
+      { eventId: 1, actionId: 2, dataId: '1 UNION SELECT 1', status: 'pending' },
+    ] as any);
+    jest.spyOn(NodeModel, 'find').mockResolvedValue([
+      { flowId: 9, action: { originName: 'people', originKey: 'person_id' } },
+    ] as any);
+    jest.spyOn(Flow, 'findOne').mockResolvedValue(null as any);
+    const ctrl = new FlowInstanceController('flow-nd', null, pxpConfig);
+    await ctrl.eventProcesss({} as any);
+    expect(query).toHaveBeenCalledWith(
+      'SELECT * FROM `people` WHERE `person_id` = ?',
+      ['1 UNION SELECT 1'],
+    );
+  });
+
+  it('RecursiveInstance binds dataId and uses the action identifiers', async () => {
+    const { query } = queryManager();
+    const ctrl = new NodeInstanceController('flow-nd', NodeInstanceModel, pxpConfig);
+    await ctrl.RecursiveInstance({
+      node: {
+        nodeId: 3,
+        actionConfigJson: '',
+        action: {
+          originName: 'people',
+          originKey: 'person_id',
+          configJsonTemplate: '',
+          actionType: { isDelay: 'N', controller: '' },
+        },
+      },
+      flowInstance: {
+        flowInstanceId: 8,
+        originName: 'evil',
+        originKey: 'evil',
+        dataId: '1 UNION SELECT 1',
+      },
+    }, { save: jest.fn() } as any);
+    expect(query.mock.calls[0][0]).toBe('SELECT * FROM `people` WHERE `person_id` = ?');
+    expect(query.mock.calls[0][1]).toEqual(['1 UNION SELECT 1']);
+    expect(query.mock.calls[0][0]).not.toContain('evil');
+  });
+});
+
+describe('getParameterizedNode vendor', () => {
+  it('fills the template with the session vendor', async () => {
+    const ctrl = new NodeController('flow-nd', NodeModel, pxpConfig);
+    ctrl.user = { harmony: { vendor_id: 7 } };
+    const qb = {
+      innerJoin: jest.fn().mockReturnThis(),
+      where: jest.fn().mockReturnThis(),
+      getMany: jest.fn().mockResolvedValue([]),
+    };
+    jest.spyOn(NodeModel, 'findOne')
+      .mockResolvedValueOnce({
+        flowId: 1,
+        actionConfigJson: null,
+        action: {
+          schemaJson: '{"v":{{vendorId}}}',
+          configJsonTemplate: null,
+          actionType: { schemaJson: null },
+        },
+      } as any)
+      .mockResolvedValueOnce({ action: { originName: 'people' } } as any);
+    const result: any = await ctrl.getParameterizedNode(
+      { nodeId: 1, substitutionsSchemaJson: { vendorId: 99 } },
+      { createQueryBuilder: () => qb } as any,
+    );
+    expect(result.schemaJsonObject.v).toBe(7);
+  });
+});
+
+describe('flowFilterColumn', () => {
+  it('maps a known field and rejects anything else', () => {
+    expect(flowFilterColumn('name')).toBe('name');
+    expect(flowFilterColumn('createdAt')).toBe('created_at');
+    expect(() => flowFilterColumn('name; drop table twf_flow')).toThrow(PxpError);
+  });
+});

package/test/tsconfig.json

@@ -0,0 +1,9 @@
+{
+  "extends": "../tsconfig.json",
+  "compilerOptions": {
+    "rootDir": "..",
+    "noEmit": true,
+    "types": ["jest", "node"]
+  },
+  "include": ["../src/**/*.ts", "./**/*.ts"]
+}