@pxp-nd/flow 1.1.31 → 1.1.32

package/dist/controllers/Flow.js

@@ -68,6 +68,7 @@ const NodeConnection_1 = __importDefault(require("../entity/NodeConnection"));
 const Flow_1 = __importDefault(require("../entity/Flow"));
 const FlowInstance_1 = __importDefault(require("../entity/FlowInstance"));
 const Node_2 = __importDefault(require("./Node"));
+const flowFilter_1 = require("../helpers/flowFilter");
 const axios_1 = __importDefault(require("axios"));
 //import {configFacebookStrategy} from "./passport-facebook";
 const FlowNdApiDocs_1 = require("../helpers/FlowNdApiDocs");
@@ -192,14 +193,10 @@ let Flow = class Flow extends core_1.Controller {
             dataFlow.modifiedBy = this.user.username;
             const updFlow = await (0, core_1.__)(manager.save(dataFlow));
             if (updFlow) {
-                let flowInstance = `UPDATE twf_flow_instance SET
-            is_active = 'N' WHERE flow_id = ${updFlow.flowId}`;
-                await manager.query(flowInstance);
+                await manager.query(`UPDATE twf_flow_instance SET is_active = 'N' WHERE flow_id = ?`, [updFlow.flowId]);
                 const nodesToInact = await manager.find(Node_1.default, { flowId: updFlow.flowId, isActive: true });
                 if (nodesToInact.length > 0) {
-                    let flowNode = `UPDATE twf_node SET
-            is_active = 'N' WHERE flow_id = ${updFlow.flowId}`;
-                    await manager.query(flowNode);
+                    await manager.query(`UPDATE twf_node SET is_active = 'N' WHERE flow_id = ?`, [updFlow.flowId]);
                     const nodesToInact = await manager.find(Node_1.default, { flowId: updFlow.flowId });
                     const originalNodeIds = nodesToInact.map((node) => node.nodeId);
                     const connectionsToInact = await manager.find(NodeConnection_1.default, {
@@ -207,9 +204,7 @@ let Flow = class Flow extends core_1.Controller {
                     });
                     const originalNodeCIds = connectionsToInact.map((node) => node.nodeConnectionId);
                     if (originalNodeCIds.length > 0) {
-                        let flowNodeC = `UPDATE twf_node_connection SET
-            is_active = 'N' WHERE node_connection_id in ( ${originalNodeCIds})`;
-                        await manager.query(flowNodeC);
+                        await manager.query(`UPDATE twf_node_connection SET is_active = 'N' WHERE node_connection_id IN (?)`, [originalNodeCIds]);
                     }
                 }
                 return { success: true };
@@ -328,9 +323,9 @@ let Flow = class Flow extends core_1.Controller {
                         });
                         if (connectionsToDel) {
                             const originalNodeCIds = connectionsToDel.map((node) => node.nodeConnectionId);
-                            let flowNodeC = await manager.query(`DELETE
-                                                       from twf_node_connection
-                                                       WHERE node_connection_id = ${originalNodeCIds}`);
+                            if (originalNodeCIds.length > 0) {
+                                await manager.query(`DELETE FROM twf_node_connection WHERE node_connection_id IN (?)`, [originalNodeCIds]);
+                            }
                         }
                     }
                 }
@@ -349,9 +344,9 @@ let Flow = class Flow extends core_1.Controller {
                     allowModify = true;
                     //If there are some nodes in node_connections after delete all records sent, to inactive node
                     let connectNoDel = await (0, typeorm_1.getManager)().query(`SELECT n.node_id
-                                                    from twf_node_connection nd
-                                                           inner join twf_node n on n.node_id = nd.node_id_child
-                                                    WHERE n.node_id = ${nodeDelId}`);
+                 FROM twf_node_connection nd
+                 INNER JOIN twf_node n ON n.node_id = nd.node_id_child
+                 WHERE n.node_id = ?`, [nodeDelId]);
                     const currentNodesIds = connectNoDel.map((record) => record.node_id);
                     // Get nodes to remove
                     const nodesToRemove = currentNodesIds.filter((nodeId) => !taskIds.includes(nodeId.toString()));
@@ -359,10 +354,7 @@ let Flow = class Flow extends core_1.Controller {
                     if (nodesToRemove.length > 0) {
                         const delNodeConnect = await manager.delete(NodeConnection_1.default, { nodeIdChild: nodesToRemove[0] });
                         if (delNodeConnect) {
-                            let dNode = `UPDATE twf_node
-                        SET is_active = 'N'
-                        WHERE node_id = ${nodesToRemove[0]}`;
-                            await manager.query(dNode);
+                            await manager.query(`UPDATE twf_node SET is_active = 'N' WHERE node_id = ?`, [nodesToRemove[0]]);
                         }
                     }
                     if (flowIdDel.action.actionType.name === 'CHAINED FLOW') {
@@ -842,7 +834,7 @@ let Flow = class Flow extends core_1.Controller {
         const applyDynamicFilters = (queryBuilder, filters, logicOperator) => {
             filters.forEach((filter, index) => {
                 const { field, operator, value } = filter;
-                const queryField = `f.${field}`;
+                const queryField = `f.${(0, flowFilter_1.flowFilterColumn)(field)}`;
                 const parameterName = `filterValue${index}`;
                 let condition;
                 switch (operator) {
@@ -1006,7 +998,7 @@ let Flow = class Flow extends core_1.Controller {
         const applyDynamicFilters = (queryBuilder, filters, logicOperator) => {
             filters.forEach((filter, index) => {
                 const { field, operator, value } = filter;
-                const queryField = `f.${field}`;
+                const queryField = `f.${(0, flowFilter_1.flowFilterColumn)(field)}`;
                 const parameterName = `filterValue${index}`;
                 let condition;
                 switch (operator) {

package/dist/controllers/FlowInstance.js

@@ -41,6 +41,7 @@ const Flow_1 = __importDefault(require("../entity/Flow"));
 const Action_1 = __importDefault(require("../entity/Action"));
 const FlowLog_1 = __importDefault(require("../entity/FlowLog"));
 const dbLock_1 = require("../helpers/dbLock");
+const sqlIdent_1 = require("../helpers/sqlIdent");
 class FlowInstance extends core_1.Controller {
     async processPending(params, manager) {
         let flowInstanceIdProcessing = -1;
@@ -89,8 +90,7 @@ class FlowInstance extends core_1.Controller {
                 for (const n of node) {
                     //get data of view
                     const { action: { originName, originKey }, } = n;
-                    const executeView = `select * from ${originName} where ${originKey} = ${newEvent.dataId}`;
-                    const resExecuteView = await (0, typeorm_1.getManager)().query(executeView);
+                    const resExecuteView = await (0, sqlIdent_1.selectByIdent)((0, typeorm_1.getManager)(), originName, originKey, newEvent.dataId);
                     const flow = await (0, core_1.__)(Flow_1.default.findOne({ where: { flowId: n.flowId, isActive: 1, status: 'on' } }));
                     if (flow && flow.vendorId == resExecuteView[0].vendor_id &&
                         (await this.checkConditions(resExecuteView[0], n.flowId, newEvent.actionId))) {

package/dist/controllers/Node.js

@@ -37,11 +37,12 @@ const OriginName_1 = __importDefault(require("../entity/OriginName"));
 const axios_1 = __importDefault(require("axios"));
 const Flow_1 = __importDefault(require("../entity/Flow"));
 const FlowNdApiDocs_1 = require("../helpers/FlowNdApiDocs");
+const sqlIdent_1 = require("../helpers/sqlIdent");
+const sessionVendor_1 = require("../helpers/sessionVendor");
 let Node = class Node extends core_1.Controller {
     async getNodeData(node, dataId, manager) {
         const { action: { originName, originKey } } = node;
-        const executeView = `select * from ${originName} where ${originKey} = ${dataId}`;
-        const resExecuteView = await (0, core_1.__)(manager.query(executeView));
+        const resExecuteView = await (0, core_1.__)((0, sqlIdent_1.selectByIdent)(manager, originName, originKey, dataId));
         return JSON.stringify(resExecuteView[0]);
     }
     async add(params, manager) {
@@ -119,7 +120,14 @@ let Node = class Node extends core_1.Controller {
         if (!Number.isInteger(nid) || nid < 1) {
             throw new core_1.PxpError(400, 'nodeId is required and must be a positive integer');
         }
-        const { nodeId, flowId, substitutionsSchemaJson = {} } = params;
+        const { nodeId, flowId } = params;
+        const requestedSubstitutions = params.substitutionsSchemaJson && typeof params.substitutionsSchemaJson === 'object'
+            ? { ...params.substitutionsSchemaJson }
+            : {};
+        const sessionVendor = (0, sessionVendor_1.harmonyVendorId)(this.user);
+        const substitutionsSchemaJson = sessionVendor != null
+            ? { ...requestedSubstitutions, vendorId: sessionVendor }
+            : requestedSubstitutions;
         const tNodeData = (0, core_1.__)(Node_1.default.findOne(nodeId));
         const nodeData = await tNodeData;
         const tNodeOrigin = await (0, core_1.__)(Node_1.default.findOne({
@@ -261,17 +269,15 @@ let Node = class Node extends core_1.Controller {
         };
     }
     async executeActionJson(params, manager) {
-        const { nodeId, originName, originKey, fromValues } = params;
-        // we need to get the value from merge values with originKey
+        const { nodeId, fromValues } = params;
+        const nodeRow = await (0, core_1.__)(Node_1.default.findOne({ where: { nodeId }, relations: ['action'] }));
+        if (!nodeRow || !nodeRow.action) {
+            throw new core_1.PxpError(400, 'Invalid origin');
+        }
         const getParameterizedNodeData = await (0, core_1.__)(this.getParameterizedNode({ nodeId: nodeId }, manager));
         const { mergeValues } = getParameterizedNodeData;
-        const findOriginValue = Object.entries(mergeValues).find(([nameValue]) => fromValues === nameValue);
-        const resValueObject = Object.fromEntries([findOriginValue]);
-        const originValue = resValueObject[fromValues];
-        const executeViewString = `select * from ${originName} where ${originKey} = ${originValue}`;
-        const resExecuteView = await (0, typeorm_1.getManager)().query(executeViewString);
-        /*const executeView = `select * from ${originName} where ${originKey} = ${newEvent.dataId}`;
-        const resExecuteView = await getManager().query(executeView);*/
+        const originValue = mergeValues ? mergeValues[fromValues] : undefined;
+        const resExecuteView = await (0, sqlIdent_1.selectByIdent)((0, typeorm_1.getManager)(), nodeRow.action.originName, nodeRow.action.originKey, originValue);
         return {
             ...resExecuteView[0]
         };

package/dist/controllers/NodeInstance.js

@@ -42,18 +42,20 @@ const Action_1 = __importDefault(require("../entity/Action"));
 const lodash_1 = __importDefault(require("lodash"));
 const FlowInstance_1 = __importDefault(require("../entity/FlowInstance"));
 const dbLock_1 = require("../helpers/dbLock");
+const sqlIdent_1 = require("../helpers/sqlIdent");
 //TODO replace this flow-nd need tobe independent library
 const common_1 = require("@pxp-nd/common");
 let NodeInstance = class NodeInstance extends core_1.Controller {
     async RecursiveInstance(params, manager) {
-        var _a;
+        var _a, _b, _c, _d, _e;
         //https://lodash.com/docs/4.17.15#template
         lodash_1.default.templateSettings.interpolate = /{{([\s\S]+?)}}/g;
         //todo after this we need to get the json variables and execute the view and conditions configured in the database
         const { node, flowInstance, eventNode } = params;
         try {
-            const executeView = `select * from ${flowInstance.originName} where ${flowInstance.originKey} = ${flowInstance.dataId}`;
-            const resExecuteView = await (0, core_1.__)((0, typeorm_1.getManager)().query(executeView));
+            const originName = (_b = (_a = node === null || node === void 0 ? void 0 : node.action) === null || _a === void 0 ? void 0 : _a.originName) !== null && _b !== void 0 ? _b : flowInstance.originName;
+            const originKey = (_d = (_c = node === null || node === void 0 ? void 0 : node.action) === null || _c === void 0 ? void 0 : _c.originKey) !== null && _d !== void 0 ? _d : flowInstance.originKey;
+            const resExecuteView = await (0, core_1.__)((0, sqlIdent_1.selectByIdent)((0, typeorm_1.getManager)(), originName, originKey, flowInstance.dataId));
             const resultFromOrigin = resExecuteView[0];
             //let mergeJson = {};
             let mergeJson = {};
@@ -94,7 +96,7 @@ let NodeInstance = class NodeInstance extends core_1.Controller {
                     if (nodeInstanceId) {
                         mergeJson.nodeInstanceId = nodeInstanceId;
                     }
-                    if (!!((_a = node === null || node === void 0 ? void 0 : node.action) === null || _a === void 0 ? void 0 : _a.controllerFunction)) {
+                    if (!!((_e = node === null || node === void 0 ? void 0 : node.action) === null || _e === void 0 ? void 0 : _e.controllerFunction)) {
                         const config = {
                             method: "post",
                             url: `http://localhost:${process.env.PORT}/api/${node.action.controllerFunction}`,

package/dist/helpers/flowFilter.d.ts

@@ -0,0 +1,13 @@
+/*****************************************************************************
+ * Copyright(c) 2026 Qorus Inc
+ * All rights reserved
+ *****************************************************************************
+ * NAME: flowFilter.ts
+ * DEVELOPER: Rensi Arteaga
+ * DESCRIPTION: Whitelist of flow list filter columns. Client field names are not interpolated.
+ * REVISIONS:
+ * Date Change      ID              Author              Description
+ * -----------      -----------     --------------      ------------------------------------
+ * 10-Nov-2026                      Rensi Arteaga       Created
+ ******************************************************************************/
+export declare function flowFilterColumn(field: unknown): string;

package/dist/helpers/flowFilter.js

@@ -0,0 +1,56 @@
+"use strict";
+/*****************************************************************************
+ * Copyright(c) 2026 Qorus Inc
+ * All rights reserved
+ *****************************************************************************
+ * NAME: flowFilter.ts
+ * DEVELOPER: Rensi Arteaga
+ * DESCRIPTION: Whitelist of flow list filter columns. Client field names are not interpolated.
+ * REVISIONS:
+ * Date Change      ID              Author              Description
+ * -----------      -----------     --------------      ------------------------------------
+ * 10-Nov-2026                      Rensi Arteaga       Created
+ ******************************************************************************/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.flowFilterColumn = void 0;
+const core_1 = require("@pxp-nd/core");
+const FLOW_FILTER_COLUMNS = {
+    flowId: 'flow_id',
+    flow_id: 'flow_id',
+    vendorId: 'vendor_id',
+    vendor_id: 'vendor_id',
+    code: 'code',
+    name: 'name',
+    enabled: 'enabled',
+    type: 'type',
+    createdBy: 'created_by',
+    created_by: 'created_by',
+    modifiedBy: 'modified_by',
+    modified_by: 'modified_by',
+    createdAt: 'created_at',
+    created_at: 'created_at',
+    modifiedAt: 'modified_at',
+    modified_at: 'modified_at',
+    isActive: 'is_active',
+    is_active: 'is_active',
+    description: 'description',
+    icon: 'icon',
+    status: 'status',
+    templateType: 'template_type',
+    template_type: 'template_type',
+    flowType: 'flow_type',
+    flow_type: 'flow_type',
+    publish: 'publish',
+    userIdAi: 'user_id_ai',
+    user_id_ai: 'user_id_ai',
+    userAi: 'user_ai',
+    user_ai: 'user_ai',
+};
+function flowFilterColumn(field) {
+    const column = FLOW_FILTER_COLUMNS[String(field !== null && field !== void 0 ? field : '')];
+    if (!column) {
+        throw new core_1.PxpError(400, 'Invalid filter field');
+    }
+    return column;
+}
+exports.flowFilterColumn = flowFilterColumn;

package/dist/helpers/sessionVendor.d.ts

@@ -0,0 +1,13 @@
+/*****************************************************************************
+ * Copyright(c) 2026 Qorus Inc
+ * All rights reserved
+ *****************************************************************************
+ * NAME: sessionVendor.ts
+ * DEVELOPER: Rensi Arteaga
+ * DESCRIPTION: Session vendor for flow templates. Request vendor is ignored for harmony users.
+ * REVISIONS:
+ * Date Change      ID              Author              Description
+ * -----------      -----------     --------------      ------------------------------------
+ * 10-Nov-2026                      Rensi Arteaga       Created
+ ******************************************************************************/
+export declare function harmonyVendorId(user: any): number | null;

package/dist/helpers/sessionVendor.js

@@ -0,0 +1,28 @@
+"use strict";
+/*****************************************************************************
+ * Copyright(c) 2026 Qorus Inc
+ * All rights reserved
+ *****************************************************************************
+ * NAME: sessionVendor.ts
+ * DEVELOPER: Rensi Arteaga
+ * DESCRIPTION: Session vendor for flow templates. Request vendor is ignored for harmony users.
+ * REVISIONS:
+ * Date Change      ID              Author              Description
+ * -----------      -----------     --------------      ------------------------------------
+ * 10-Nov-2026                      Rensi Arteaga       Created
+ ******************************************************************************/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.harmonyVendorId = void 0;
+function harmonyVendorId(user) {
+    var _a;
+    const raw = (_a = user === null || user === void 0 ? void 0 : user.harmony) === null || _a === void 0 ? void 0 : _a.vendor_id;
+    if (raw == null || raw === '') {
+        return null;
+    }
+    const id = Number(raw);
+    if (!Number.isInteger(id) || id <= 0) {
+        return null;
+    }
+    return id;
+}
+exports.harmonyVendorId = harmonyVendorId;

package/dist/helpers/sqlIdent.d.ts

@@ -0,0 +1,17 @@
+/*****************************************************************************
+ * Copyright(c) 2026 Qorus Inc
+ * All rights reserved
+ *****************************************************************************
+ * NAME: sqlIdent.ts
+ * DEVELOPER: Rensi Arteaga
+ * DESCRIPTION: Parameterized origin queries. Identifiers are checked, values are bound.
+ * REVISIONS:
+ * Date Change      ID              Author              Description
+ * -----------      -----------     --------------      ------------------------------------
+ * 10-Nov-2026                      Rensi Arteaga       Created
+ ******************************************************************************/
+export declare function sqlIdent(value: unknown): string;
+export declare function quoteIdent(value: unknown): string;
+export declare function selectByIdent(manager: {
+    query: (sql: string, params?: unknown[]) => Promise<any>;
+}, originName: unknown, originKey: unknown, value: unknown): Promise<any[]>;

package/dist/helpers/sqlIdent.js

@@ -0,0 +1,34 @@
+"use strict";
+/*****************************************************************************
+ * Copyright(c) 2026 Qorus Inc
+ * All rights reserved
+ *****************************************************************************
+ * NAME: sqlIdent.ts
+ * DEVELOPER: Rensi Arteaga
+ * DESCRIPTION: Parameterized origin queries. Identifiers are checked, values are bound.
+ * REVISIONS:
+ * Date Change      ID              Author              Description
+ * -----------      -----------     --------------      ------------------------------------
+ * 10-Nov-2026                      Rensi Arteaga       Created
+ ******************************************************************************/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.selectByIdent = exports.quoteIdent = exports.sqlIdent = void 0;
+const core_1 = require("@pxp-nd/core");
+const SQL_IDENT = /^[A-Za-z_][A-Za-z0-9_]*$/;
+function sqlIdent(value) {
+    const ident = String(value !== null && value !== void 0 ? value : '');
+    if (!SQL_IDENT.test(ident)) {
+        throw new core_1.PxpError(400, 'Invalid origin');
+    }
+    return ident;
+}
+exports.sqlIdent = sqlIdent;
+function quoteIdent(value) {
+    return '`' + sqlIdent(value) + '`';
+}
+exports.quoteIdent = quoteIdent;
+async function selectByIdent(manager, originName, originKey, value) {
+    const sql = `SELECT * FROM ${quoteIdent(originName)} WHERE ${quoteIdent(originKey)} = ?`;
+    return manager.query(sql, [value]);
+}
+exports.selectByIdent = selectByIdent;

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@pxp-nd/flow",
-  "version": "1.1.31",
+  "version": "1.1.32",
   "description": "Workflow module for pxp-nd framework",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "prepublish": "tsc",
   "scripts": {
-    "test": "echo \"Error: no test specified\" && exit 1",
+    "test": "jest --runInBand",
     "build": "rimraf ./dist && tsc",
     "dev:publish": "yalc publish",
     "prod:publish": "npm publish",
@@ -24,6 +24,13 @@
   ],
   "author": "Kplian",
   "license": "ISC",
+  "jest": {
+    "preset": "ts-jest",
+    "testEnvironment": "node",
+    "roots": ["<rootDir>/test"],
+    "testTimeout": 30000,
+    "globals": { "ts-jest": { "tsconfig": "<rootDir>/test/tsconfig.json" } }
+  },
   "bugs": {
     "url": "https://github.com/kplian/flow-nd/issues"
   },
@@ -31,13 +38,16 @@
   "devDependencies": {
     "@types/lodash": "^4.14.172",
     "@types/node": "^16.4.13",
+    "@types/jest": "^27.5.2",
+    "jest": "^27.5.1",
+    "ts-jest": "^27.1.5",
     "rimraf": "^3.0.2",
     "tsc-watch": "^4.6.2",
     "typescript": "^4.9.5"
   },
   "dependencies": {
     "@pxp-nd/common": "^1.1.4",
-    "@pxp-nd/core": "^1.2.94",
+    "@pxp-nd/core": "^1.2.96",
     "axios": "^0.21.1",
     "lodash": "^4.17.21",
     "typeorm": "^0.2.36"

package/test/sql-ident.test.ts

@@ -0,0 +1,168 @@
+import 'reflect-metadata';
+import { getManager } from 'typeorm';
+import { PxpError } from '@pxp-nd/core';
+import NodeModel from '../src/entity/Node';
+import NodeInstanceModel from '../src/entity/NodeInstance';
+import Event from '../src/entity/Event';
+import Flow from '../src/entity/Flow';
+import NodeController from '../src/controllers/Node';
+import FlowInstanceController from '../src/controllers/FlowInstance';
+import NodeInstanceController from '../src/controllers/NodeInstance';
+import { flowFilterColumn } from '../src/helpers/flowFilter';
+
+jest.mock('typeorm', () => {
+  const actual = jest.requireActual('typeorm');
+  return {
+    ...actual,
+    getManager: jest.fn(),
+  };
+});
+
+const pxpConfig = { apiPrefix: '/api', defaultDbSettings: 'Orm' as const, middlewares: [] as any[] };
+
+function queryManager() {
+  const query = jest.fn().mockResolvedValue([{ id: 1 }]);
+  const save = jest.fn().mockResolvedValue({});
+  (getManager as unknown as jest.Mock).mockReturnValue({ query, save });
+  return { query, save };
+}
+
+describe('select by identifier', () => {
+  it('binds a stored value and rejects a bad origin before querying', async () => {
+    const ctrl = new NodeController('flow-nd', NodeModel, pxpConfig);
+    const query = jest.fn();
+    await expect(
+      ctrl.getNodeData({ action: { originName: 'bad name', originKey: 'id' } }, 1, { query } as any)
+    ).rejects.toBeInstanceOf(PxpError);
+    expect(query).not.toHaveBeenCalled();
+
+    const ok = jest.fn().mockResolvedValue([{ id: 7 }]);
+    const raw = await ctrl.getNodeData(
+      { action: { originName: 'people', originKey: 'person_id' } },
+      '1 UNION SELECT 1',
+      { query: ok } as any,
+    );
+    expect(ok).toHaveBeenCalledWith(
+      'SELECT * FROM `people` WHERE `person_id` = ?',
+      ['1 UNION SELECT 1'],
+    );
+    expect(raw).toBe(JSON.stringify({ id: 7 }));
+  });
+
+  it('executeActionJson uses the action row, not the request identifiers', async () => {
+    const { query } = queryManager();
+    const ctrl = new NodeController('flow-nd', NodeModel, pxpConfig);
+    jest.spyOn(NodeModel, 'findOne').mockResolvedValue({
+      action: { originName: 'people', originKey: 'person_id' },
+    } as any);
+    jest.spyOn(ctrl, 'getParameterizedNode').mockResolvedValue({
+      mergeValues: { payload: '1 UNION SELECT 1' },
+    } as any);
+
+    await ctrl.executeActionJson(
+      { nodeId: 4, fromValues: 'payload', originName: 'other_table', originKey: 'other_col' },
+      {} as any,
+    );
+
+    expect(query).toHaveBeenCalledWith(
+      'SELECT * FROM `people` WHERE `person_id` = ?',
+      ['1 UNION SELECT 1'],
+    );
+    expect(query.mock.calls[0][0]).not.toContain('UNION');
+  });
+
+  it('executeActionJson rejects an action origin that is not an identifier', async () => {
+    const { query } = queryManager();
+    const ctrl = new NodeController('flow-nd', NodeModel, pxpConfig);
+    jest.spyOn(NodeModel, 'findOne').mockResolvedValue({
+      action: { originName: 'people;drop', originKey: 'id' },
+    } as any);
+    jest.spyOn(ctrl, 'getParameterizedNode').mockResolvedValue({ mergeValues: { payload: '1' } } as any);
+
+    await expect(
+      ctrl.executeActionJson({ nodeId: 4, fromValues: 'payload' }, {} as any)
+    ).rejects.toBeInstanceOf(PxpError);
+    expect(query).not.toHaveBeenCalled();
+  });
+});
+
+describe('event and node instance queries', () => {
+  it('eventProcesss binds dataId', async () => {
+    const { query } = queryManager();
+    jest.spyOn(Event, 'find').mockResolvedValue([
+      { eventId: 1, actionId: 2, dataId: '1 UNION SELECT 1', status: 'pending' },
+    ] as any);
+    jest.spyOn(NodeModel, 'find').mockResolvedValue([
+      { flowId: 9, action: { originName: 'people', originKey: 'person_id' } },
+    ] as any);
+    jest.spyOn(Flow, 'findOne').mockResolvedValue(null as any);
+    const ctrl = new FlowInstanceController('flow-nd', null, pxpConfig);
+    await ctrl.eventProcesss({} as any);
+    expect(query).toHaveBeenCalledWith(
+      'SELECT * FROM `people` WHERE `person_id` = ?',
+      ['1 UNION SELECT 1'],
+    );
+  });
+
+  it('RecursiveInstance binds dataId and uses the action identifiers', async () => {
+    const { query } = queryManager();
+    const ctrl = new NodeInstanceController('flow-nd', NodeInstanceModel, pxpConfig);
+    await ctrl.RecursiveInstance({
+      node: {
+        nodeId: 3,
+        actionConfigJson: '',
+        action: {
+          originName: 'people',
+          originKey: 'person_id',
+          configJsonTemplate: '',
+          actionType: { isDelay: 'N', controller: '' },
+        },
+      },
+      flowInstance: {
+        flowInstanceId: 8,
+        originName: 'evil',
+        originKey: 'evil',
+        dataId: '1 UNION SELECT 1',
+      },
+    }, { save: jest.fn() } as any);
+    expect(query.mock.calls[0][0]).toBe('SELECT * FROM `people` WHERE `person_id` = ?');
+    expect(query.mock.calls[0][1]).toEqual(['1 UNION SELECT 1']);
+    expect(query.mock.calls[0][0]).not.toContain('evil');
+  });
+});
+
+describe('getParameterizedNode vendor', () => {
+  it('fills the template with the session vendor', async () => {
+    const ctrl = new NodeController('flow-nd', NodeModel, pxpConfig);
+    ctrl.user = { harmony: { vendor_id: 7 } };
+    const qb = {
+      innerJoin: jest.fn().mockReturnThis(),
+      where: jest.fn().mockReturnThis(),
+      getMany: jest.fn().mockResolvedValue([]),
+    };
+    jest.spyOn(NodeModel, 'findOne')
+      .mockResolvedValueOnce({
+        flowId: 1,
+        actionConfigJson: null,
+        action: {
+          schemaJson: '{"v":{{vendorId}}}',
+          configJsonTemplate: null,
+          actionType: { schemaJson: null },
+        },
+      } as any)
+      .mockResolvedValueOnce({ action: { originName: 'people' } } as any);
+    const result: any = await ctrl.getParameterizedNode(
+      { nodeId: 1, substitutionsSchemaJson: { vendorId: 99 } },
+      { createQueryBuilder: () => qb } as any,
+    );
+    expect(result.schemaJsonObject.v).toBe(7);
+  });
+});
+
+describe('flowFilterColumn', () => {
+  it('maps a known field and rejects anything else', () => {
+    expect(flowFilterColumn('name')).toBe('name');
+    expect(flowFilterColumn('createdAt')).toBe('created_at');
+    expect(() => flowFilterColumn('name; drop table twf_flow')).toThrow(PxpError);
+  });
+});

package/test/tsconfig.json

@@ -0,0 +1,9 @@
+{
+  "extends": "../tsconfig.json",
+  "compilerOptions": {
+    "rootDir": "..",
+    "noEmit": true,
+    "types": ["jest", "node"]
+  },
+  "include": ["../src/**/*.ts", "./**/*.ts"]
+}