@simplysm/orm-common 13.0.69 → 13.0.71

package/tests/dml/upsert.spec.ts

@@ -0,0 +1,242 @@
+import { describe, expect, it } from "vitest";
+import { createTestDb } from "../setup/TestDbContext";
+import { expr } from "../../src/expr/expr";
+import { createQueryBuilder } from "../../src/query-builder/query-builder";
+import { dialects } from "../setup/test-utils";
+import "../setup/test-utils"; // toMatchSql matcher
+import * as expected from "./upsert.expected";
+
+describe("UPSERT - Basic", () => {
+  describe("simple UPSERT (WHERE condition)", () => {
+    const db = createTestDb();
+    const def = db
+      .employee()
+      .where((e) => [expr.eq(e.id, 1)])
+      .getUpsertQueryDef(
+        () => ({ name: expr.val("string", "new name") }),
+        (upd) => ({ name: upd.name, departmentId: expr.val("number", 1) }),
+      );
+
+    it("should validate QueryDef", () => {
+      expect(def).toEqual({
+        type: "upsert",
+        table: { database: "TestDb", schema: "TestSchema", name: "Employee" },
+        existsSelectQuery: {
+          type: "select",
+          as: "T1",
+          from: { database: "TestDb", schema: "TestSchema", name: "Employee" },
+          where: [
+            {
+              type: "eq",
+              source: { type: "column", path: ["T1", "id"] },
+              target: { type: "value", value: 1 },
+            },
+          ],
+        },
+        updateRecord: {
+          name: { type: "value", value: "new name" },
+        },
+        insertRecord: {
+          name: { type: "value", value: "new name" },
+          departmentId: { type: "value", value: 1 },
+        },
+      });
+    });
+
+    it.each(dialects)("[%s] should validate SQL", (dialect) => {
+      const builder = createQueryBuilder(dialect);
+      expect(builder.build(def)).toMatchSql(expected.upsertSimple[dialect]);
+    });
+  });
+
+  describe("INSERT reusing UPDATE values", () => {
+    const db = createTestDb();
+    const def = db
+      .employee()
+      .where((e) => [expr.eq(e.id, 1)])
+      .getUpsertQueryDef(
+        () => ({
+          name: expr.val("string", "Gildong Hong"),
+          departmentId: expr.val("number", 2),
+        }),
+        (upd) => ({
+          ...upd,
+          managerId: expr.val("number", 100),
+        }),
+      );
+
+    it("Verify QueryDef", () => {
+      expect(def).toEqual({
+        type: "upsert",
+        table: { database: "TestDb", schema: "TestSchema", name: "Employee" },
+        existsSelectQuery: {
+          type: "select",
+          as: "T1",
+          from: { database: "TestDb", schema: "TestSchema", name: "Employee" },
+          where: [
+            {
+              type: "eq",
+              source: { type: "column", path: ["T1", "id"] },
+              target: { type: "value", value: 1 },
+            },
+          ],
+        },
+        updateRecord: {
+          name: { type: "value", value: "Gildong Hong" },
+          departmentId: { type: "value", value: 2 },
+        },
+        insertRecord: {
+          name: { type: "value", value: "Gildong Hong" },
+          departmentId: { type: "value", value: 2 },
+          managerId: { type: "value", value: 100 },
+        },
+      });
+    });
+
+    it.each(dialects)("[%s] should validate SQL", (dialect) => {
+      const builder = createQueryBuilder(dialect);
+      expect(builder.build(def)).toMatchSql(expected.upsertReuse[dialect]);
+    });
+  });
+
+  describe("Specify output column", () => {
+    const db = createTestDb();
+    const def = db
+      .employee()
+      .where((e) => [expr.eq(e.id, 1)])
+      .getUpsertQueryDef(
+        () => ({ name: expr.val("string", "New Name") }),
+        (upd) => ({ name: upd.name }),
+        ["id", "name"],
+      );
+
+    it("Verify QueryDef", () => {
+      expect(def).toEqual({
+        type: "upsert",
+        table: { database: "TestDb", schema: "TestSchema", name: "Employee" },
+        existsSelectQuery: {
+          type: "select",
+          as: "T1",
+          from: { database: "TestDb", schema: "TestSchema", name: "Employee" },
+          where: [
+            {
+              type: "eq",
+              source: { type: "column", path: ["T1", "id"] },
+              target: { type: "value", value: 1 },
+            },
+          ],
+        },
+        updateRecord: {
+          name: { type: "value", value: "New Name" },
+        },
+        insertRecord: {
+          name: { type: "value", value: "New Name" },
+        },
+        output: {
+          columns: ["id", "name"],
+          pkColNames: ["id"],
+          aiColName: "id",
+        },
+      });
+    });
+
+    it.each(dialects)("[%s] should validate SQL", (dialect) => {
+      const builder = createQueryBuilder(dialect);
+      expect(builder.build(def)).toMatchSql(expected.upsertWithOutput[dialect]);
+    });
+  });
+
+  describe("Complex WHERE condition", () => {
+    const db = createTestDb();
+    const def = db
+      .employee()
+      .where((e) => [expr.eq(e.name, "Gildong Hong"), expr.eq(e.departmentId, 1)])
+      .getUpsertQueryDef(
+        () => ({ managerId: expr.val("number", 10) }),
+        (upd) => ({
+          name: expr.val("string", "Gildong Hong"),
+          departmentId: expr.val("number", 1),
+          managerId: upd.managerId,
+        }),
+      );
+
+    it("Verify QueryDef", () => {
+      expect(def).toEqual({
+        type: "upsert",
+        table: { database: "TestDb", schema: "TestSchema", name: "Employee" },
+        existsSelectQuery: {
+          type: "select",
+          as: "T1",
+          from: { database: "TestDb", schema: "TestSchema", name: "Employee" },
+          where: [
+            {
+              type: "eq",
+              source: { type: "column", path: ["T1", "name"] },
+              target: { type: "value", value: "Gildong Hong" },
+            },
+            {
+              type: "eq",
+              source: { type: "column", path: ["T1", "departmentId"] },
+              target: { type: "value", value: 1 },
+            },
+          ],
+        },
+        updateRecord: {
+          managerId: { type: "value", value: 10 },
+        },
+        insertRecord: {
+          name: { type: "value", value: "Gildong Hong" },
+          departmentId: { type: "value", value: 1 },
+          managerId: { type: "value", value: 10 },
+        },
+      });
+    });
+
+    it.each(dialects)("[%s] should validate SQL", (dialect) => {
+      const builder = createQueryBuilder(dialect);
+      expect(builder.build(def)).toMatchSql(expected.upsertMultiWhere[dialect]);
+    });
+  });
+
+  describe("UPSERT with literal values (without expr.val)", () => {
+    const db = createTestDb();
+    const def = db
+      .employee()
+      .where((e) => [expr.eq(e.id, 1)])
+      .getUpsertQueryDef(
+        () => ({ name: "New Name" }),
+        (upd) => ({ name: upd.name, departmentId: 1 }),
+      );
+
+    it("Verify QueryDef", () => {
+      expect(def).toEqual({
+        type: "upsert",
+        table: { database: "TestDb", schema: "TestSchema", name: "Employee" },
+        existsSelectQuery: {
+          type: "select",
+          as: "T1",
+          from: { database: "TestDb", schema: "TestSchema", name: "Employee" },
+          where: [
+            {
+              type: "eq",
+              source: { type: "column", path: ["T1", "id"] },
+              target: { type: "value", value: 1 },
+            },
+          ],
+        },
+        updateRecord: {
+          name: { type: "value", value: "New Name" },
+        },
+        insertRecord: {
+          name: { type: "value", value: "New Name" },
+          departmentId: { type: "value", value: 1 },
+        },
+      });
+    });
+
+    it.each(dialects)("[%s] should validate SQL", (dialect) => {
+      const builder = createQueryBuilder(dialect);
+      expect(builder.build(def)).toMatchSql(expected.upsertPlainValues[dialect]);
+    });
+  });
+});

package/tests/errors/queryable-errors.spec.ts

@@ -0,0 +1,177 @@
+import { describe, it, expect } from "vitest";
+import { createTestDb } from "../setup/TestDbContext";
+import { Queryable } from "../../src/exec/queryable";
+import { createQueryBuilder } from "../../src/query-builder/query-builder";
+import { expr } from "../../src/expr/expr";
+
+describe("Queryable error cases", () => {
+  describe("expr.and()/expr.or() errors", () => {
+    it("ArgumentError when calling and() with empty array", () => {
+      expect(() => expr.and([])).toThrow("empty arrays are not allowed");
+    });
+
+    it("ArgumentError when calling or() with empty array", () => {
+      expect(() => expr.or([])).toThrow("empty arrays are not allowed");
+    });
+  });
+
+  describe("executable errors", () => {
+    it("Error when passing parameters to procedure without parameters", () => {
+      const db = createTestDb();
+      expect(() => {
+        // @ts-expect-error - test passing parameters to a procedure that expects none
+        db.getAllUsers().getExecProcQueryDef({ unexpectedParam: 1 });
+      }).toThrow("has no parameters.");
+    });
+  });
+
+  describe("include() errors", () => {
+    it("Error when including non-existent relation", () => {
+      const db = createTestDb();
+
+      expect(() => {
+        // @ts-expect-error - non-existent relation test
+        db.user().include((item) => item.nonExistentRelation);
+      }).toThrow("Relation 'nonExistentRelation' not found.");
+    });
+
+    it("Error when calling include on ViewBuilder-based queryable", () => {
+      const db = createTestDb();
+
+      expect(() => {
+        // @ts-expect-error - ViewBuilder has no relations, include not supported
+        db.activeUsers().include((item) => item.someRelation);
+      }).toThrow("include() can only be used on TableBuilder-based queryables.");
+    });
+  });
+
+  describe("union() errors", () => {
+    it("Error when calling union with a single queryable", () => {
+      const db = createTestDb();
+
+      expect(() => {
+        Queryable.union(db.user());
+      }).toThrow("union requires at least 2 queryables.");
+    });
+  });
+
+  describe("limit() errors", () => {
+    it("Error when calling limit without ORDER BY", () => {
+      const db = createTestDb();
+
+      expect(() => {
+        db.user().limit(0, 10);
+      }).toThrow("limit() requires ORDER BY clause.");
+    });
+  });
+
+  describe("regexp() errors", () => {
+    it("Error when using regexp in MSSQL", () => {
+      const db = createTestDb();
+      const def = db
+        .user()
+        .where((item) => [expr.regexp(item.name, "^test.*")])
+        .getSelectQueryDef();
+
+      const builder = createQueryBuilder("mssql");
+      expect(() => {
+        builder.build(def);
+      }).toThrow("MSSQL does not natively support REGEXP.");
+    });
+  });
+
+  describe("inQuery() errors", () => {
+    it("Error when using multi-column subquery", () => {
+      const db = createTestDb();
+
+      expect(() => {
+        db.user()
+          .where((u) => [
+            expr.inQuery(
+              u.id,
+              // @ts-expect-error - multi-column subquery
+              db.post().select((p) => ({ userId: p.userId, title: p.title })),
+            ),
+          ])
+          .getSelectQueryDef();
+      }).toThrow("inQuery subquery must SELECT only a single column.");
+    });
+
+    it("Error when using subquery without column specification", () => {
+      const db = createTestDb();
+
+      expect(() => {
+        db.user()
+          .where((u) => [
+            expr.inQuery(
+              u.id,
+              // @ts-expect-error - subquery without SELECT
+              db.post(),
+            ),
+          ])
+          .getSelectQueryDef();
+      }).toThrow("inQuery subquery must SELECT only a single column.");
+    });
+  });
+
+  describe("countAsync() errors", () => {
+    it("Error when calling directly after distinct()", async () => {
+      const db = createTestDb();
+
+      await expect(
+        db
+          .user()
+          .select((u) => ({ name: u.name }))
+          .distinct()
+          .count(),
+      ).rejects.toThrow(
+        "Cannot use count() after distinct(). Use wrap() first.",
+      );
+    });
+
+    it("Error when calling directly after groupBy()", async () => {
+      const db = createTestDb();
+
+      await expect(
+        db
+          .user()
+          .groupBy((u) => [u.name])
+          .count(),
+      ).rejects.toThrow("Cannot use count() after groupBy(). Use wrap() first.");
+    });
+  });
+
+  describe("RecursiveQueryable.union() errors", () => {
+    it("Error when calling union with a single queryable", () => {
+      const db = createTestDb();
+
+      expect(() => {
+        db.employee()
+          .where((e) => [expr.null(e.managerId)])
+          .recursive((cte) => cte.union(db.employee()));
+      }).toThrow("union requires at least 2 queryables.");
+    });
+
+    it("Error when calling union with zero queryables", () => {
+      const db = createTestDb();
+
+      expect(() => {
+        db.employee()
+          .where((e) => [expr.null(e.managerId)])
+          .recursive((cte) => cte.union());
+      }).toThrow("union requires at least 2 queryables.");
+    });
+  });
+
+  describe("JoinQueryable.union() errors", () => {
+    it("Error when calling union with a single queryable inside join", () => {
+      const db = createTestDb();
+
+      expect(() => {
+        db.user().join("posts", (j, u) =>
+          j.union(db.post().where((p) => [expr.eq(p.userId, u.id)])),
+        );
+      }).toThrow("union requires at least 2 queryables.");
+    });
+  });
+});

package/tests/escape.spec.ts

@@ -0,0 +1,100 @@
+import { describe, it, expect } from "vitest";
+import { MysqlExprRenderer } from "../src/query-builder/mysql/mysql-expr-renderer";
+
+describe("MysqlExprRenderer.escapeString", () => {
+  const renderer = new MysqlExprRenderer(() => "");
+
+  //#region ========== Basic Escaping ==========
+
+  it("should escape quotes", () => {
+    const result = renderer.escapeString("O'Reilly");
+    expect(result).toBe("O''Reilly");
+  });
+
+  it("should escape backslashes", () => {
+    const result = renderer.escapeString("C:\\path");
+    expect(result).toBe("C:\\\\path");
+  });
+
+  it("should escape NULL bytes", () => {
+    const result = renderer.escapeString("admin\0--");
+    expect(result).toBe("admin\\0--");
+  });
+
+  //#endregion
+
+  //#region ========== Control Character Escaping ==========
+
+  it("should escape newlines", () => {
+    const result = renderer.escapeString("line1\nline2");
+    expect(result).toBe("line1\\nline2");
+  });
+
+  it("should escape carriage returns", () => {
+    const result = renderer.escapeString("line1\rline2");
+    expect(result).toBe("line1\\rline2");
+  });
+
+  it("should escape tabs", () => {
+    const result = renderer.escapeString("col1\tcol2");
+    expect(result).toBe("col1\\tcol2");
+  });
+
+  //#endregion
+
+  //#region ========== Combined Attack Test ==========
+
+  it("should defend against SQL injection attempts", () => {
+    const malicious = "'; DROP TABLE users; --";
+    const result = renderer.escapeString(malicious);
+    expect(result).toBe("''; DROP TABLE users; --");
+  });
+
+  it("should defend against backslash + quote combination", () => {
+    const malicious = "\\'";
+    const result = renderer.escapeString(malicious);
+    expect(result).toBe("\\\\''");
+  });
+
+  it("should defend against NULL byte + SQL comment combination", () => {
+    const malicious = "admin\0-- ";
+    const result = renderer.escapeString(malicious);
+    expect(result).toBe("admin\\0-- ");
+  });
+
+  //#endregion
+});
+
+describe("MysqlExprRenderer.escapeValue", () => {
+  const renderer = new MysqlExprRenderer(() => "");
+
+  it("escapes string with escapeString() and wraps in quotes", () => {
+    const result = renderer.escapeValue("O'Reilly");
+    expect(result).toBe("'O''Reilly'");
+  });
+
+  it("correctly escapes string containing backslashes", () => {
+    const result = renderer.escapeValue("C:\\path");
+    expect(result).toBe("'C:\\\\path'");
+  });
+
+  it("defends against SQL injection attempts", () => {
+    const result = renderer.escapeValue("'; DROP TABLE users; --");
+    expect(result).toBe("'''; DROP TABLE users; --'");
+  });
+
+  it("returns 'NULL' string for null", () => {
+    const result = renderer.escapeValue(null);
+    expect(result).toBe("NULL");
+  });
+
+  it("converts number to string", () => {
+    const result = renderer.escapeValue(123);
+    expect(result).toBe("123");
+  });
+
+  it("converts boolean to TRUE/FALSE", () => {
+    expect(renderer.escapeValue(true)).toBe("TRUE");
+    expect(renderer.escapeValue(false)).toBe("FALSE");
+  });
+});