@smartive/datocms-utils 1.2.0 → 1.3.1

package/.github/workflows/release.yml

@@ -11,8 +11,8 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
         with:
           node-version: 20
       - run: npm ci

package/.github/workflows/test.yml

@@ -15,8 +15,8 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
         with:
           node-version: 20
       - run: npm ci

package/CHANGELOG.md

@@ -1,6 +1,6 @@
-# [1.2.0](https://github.com/smartive/datocms-utils/compare/v1.1.0...v1.2.0) (2024-09-27)
+## [1.3.1](https://github.com/smartive/datocms-utils/compare/v1.3.0...v1.3.1) (2024-10-22)
 
 
-### Features
+### Bug Fixes
 
-* check for empty cachtags ([#4](https://github.com/smartive/datocms-utils/issues/4)) ([e8aa483](https://github.com/smartive/datocms-utils/commit/e8aa483ca9f27462331e08c8e80bd257adca064f))
+* pass query_ids as parameter to prevent SQL injection ([#16](https://github.com/smartive/datocms-utils/issues/16)) ([cd1f454](https://github.com/smartive/datocms-utils/commit/cd1f4549451b6c2054d90c24d9459681590def9d))

package/README.md

@@ -37,3 +37,8 @@ CREATE TABLE IF NOT EXISTS query_cache_tags (
 ### Other Utilities
 
 - `classNames`: Cleans and joins an array of inputs with possible undefined or boolean values. Useful for tailwind classnames.
+
+### Types
+
+- `CacheTag`: A branded type for cache tags.
+- `CacheTagsInvalidateWebhook`: The payload of the DatoCMS cache tags invalidate webhook.

package/dist/cache-tags.js

@@ -49,7 +49,8 @@ export const queriesReferencingCacheTags = async (cacheTags) => {
     if (!cacheTags?.length) {
         return [];
     }
-    const { rows } = await sql.query(`SELECT DISTINCT query_id FROM query_cache_tags WHERE cache_tag IN (${cacheTags.map((cacheTag) => `'${cacheTag}'`).join(', ')})`);
+    const placeholders = cacheTags.map(() => '?').join(', ');
+    const { rows } = await sql.query(`SELECT DISTINCT query_id FROM query_cache_tags WHERE cache_tag IN (${placeholders})`, cacheTags);
     return rows.map((row) => row.query_id);
 };
 /**

package/dist/cache-tags.js.map

@@ -1 +1 @@
-{"version":3,"file":"cache-tags.js","sourceRoot":"","sources":["../src/cache-tags.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAgB,KAAK,EAAE,MAAM,SAAS,CAAC;AAG9C;;;;;;GAMG;AAEH,MAAM,UAAU,6BAA6B,CAAC,MAAsB;IAClE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAe,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;GAMG;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAuB,QAAsB,EAAE,SAAsB,EAAU,EAAE;IAC9G,OAAO,UAAU,CAAC,MAAM,CAAC;SACtB,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;SACvB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;SACvC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC,CAAC;AAEF;;;;;GAKG;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EAAE,OAAe,EAAE,SAAqB,EAAE,EAAE;IAClF,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;QACvB,OAAO;IACT,CAAC;IAED,MAAM,GAAG,CAAC,KAAK,CACb,uCAAuC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,OAAO,OAAO,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,yBAAyB,CACpI,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;GAKG;AAEH,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,EAAE,SAAqB,EAAqB,EAAE;IAC5F,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;QACvB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,GAAqC,MAAM,GAAG,CAAC,KAAK,CAChE,sEAAsE,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACjI,CAAC;IAEF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AACzC,CAAC,CAAC;AAEF;;;;GAIG;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,QAAkB,EAAE,EAAE;IACxD,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;QACtB,OAAO;IACT,CAAC;IACD,MAAM,GAAG,CAAC,KAAK,CAAC,mDAAmD,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACpH,CAAC,CAAC"}
+{"version":3,"file":"cache-tags.js","sourceRoot":"","sources":["../src/cache-tags.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAgB,KAAK,EAAE,MAAM,SAAS,CAAC;AAG9C;;;;;;GAMG;AAEH,MAAM,UAAU,6BAA6B,CAAC,MAAsB;IAClE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAe,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;GAMG;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAuB,QAAsB,EAAE,SAAsB,EAAU,EAAE;IAC9G,OAAO,UAAU,CAAC,MAAM,CAAC;SACtB,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;SACvB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;SACvC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC,CAAC;AAEF;;;;;GAKG;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EAAE,OAAe,EAAE,SAAqB,EAAE,EAAE;IAClF,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;QACvB,OAAO;IACT,CAAC;IAED,MAAM,GAAG,CAAC,KAAK,CACb,uCAAuC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,OAAO,OAAO,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,yBAAyB,CACpI,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;GAKG;AAEH,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,EAAE,SAAqB,EAAqB,EAAE;IAC5F,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;QACvB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,YAAY,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzD,MAAM,EAAE,IAAI,EAAE,GAAqC,MAAM,GAAG,CAAC,KAAK,CAChE,sEAAsE,YAAY,GAAG,EACrF,SAAS,CACV,CAAC;IAEF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AACzC,CAAC,CAAC;AAEF;;;;GAIG;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,QAAkB,EAAE,EAAE;IACxD,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;QACtB,OAAO;IACT,CAAC;IACD,MAAM,GAAG,CAAC,KAAK,CAAC,mDAAmD,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACpH,CAAC,CAAC"}

package/dist/types.d.ts

@@ -1,3 +1,14 @@
 export type CacheTag = string & {
     readonly _: unique symbol;
 };
+export type CacheTagsInvalidateWebhook = {
+    entity_type: 'cda_cache_tags';
+    event_type: 'invalidate';
+    entity: {
+        id: 'cda_cache_tags';
+        type: 'cda_cache_tags';
+        attributes: {
+            tags: CacheTag[];
+        };
+    };
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smartive/datocms-utils",
-  "version": "1.2.0",
+  "version": "1.3.1",
   "description": "A set of utilities and helpers to work with DatoCMS in a Next.js project.",
   "source": "src/index.ts",
   "main": "dist/index.js",

package/src/cache-tags.ts

@@ -62,8 +62,10 @@ export const queriesReferencingCacheTags = async (cacheTags: CacheTag[]): Promis
   if (!cacheTags?.length) {
     return [];
   }
+  const placeholders = cacheTags.map(() => '?').join(', ');
   const { rows }: { rows: { query_id: string }[] } = await sql.query(
-    `SELECT DISTINCT query_id FROM query_cache_tags WHERE cache_tag IN (${cacheTags.map((cacheTag) => `'${cacheTag}'`).join(', ')})`,
+    `SELECT DISTINCT query_id FROM query_cache_tags WHERE cache_tag IN (${placeholders})`,
+    cacheTags,
   );
 
   return rows.map((row) => row.query_id);

package/src/types.ts

@@ -1 +1,13 @@
 export type CacheTag = string & { readonly _: unique symbol };
+
+export type CacheTagsInvalidateWebhook = {
+  entity_type: 'cda_cache_tags';
+  event_type: 'invalidate';
+  entity: {
+    id: 'cda_cache_tags';
+    type: 'cda_cache_tags';
+    attributes: {
+      tags: CacheTag[];
+    };
+  };
+};