@teleporthq/teleport-plugin-next-data-source 0.42.35 → 0.43.0

package/src/fetchers/raw-query.ts

@@ -0,0 +1,178 @@
+import { replaceSecretReference } from '../utils'
+
+interface PostgreSQLConfig {
+  host?: string
+  port?: number
+  user?: string
+  username?: string
+  password?: string
+  database?: string
+  ssl?: boolean | { ca?: string; cert?: string; key?: string; rejectUnauthorized?: boolean }
+  sslConfig?: { ca?: string; cert?: string; key?: string; rejectUnauthorized?: boolean }
+}
+
+const FORBIDDEN_KEYWORDS = ['CREATE', 'ALTER', 'DROP', 'TRUNCATE', 'RENAME', 'GRANT', 'REVOKE']
+
+/**
+ * Generates an API route handler that executes a parameterized raw SQL query.
+ * Supports {{Current User.*}} substitution via query params.
+ *
+ * @param config - PostgreSQL connection config
+ * @param query - Raw SQL query string with {{Current User.*}} patterns already replaced to $N placeholders
+ * @param paramFields - Array of query param field names that map to $1, $2, etc. in order
+ */
+export const generateRawQueryFetcher = (
+  config: Record<string, unknown>,
+  query: string,
+  paramFields: string[]
+): string => {
+  const pgConfig = config as PostgreSQLConfig
+
+  const paramDestructure =
+    paramFields.length > 0 ? `const { ${paramFields.join(', ')} } = req.query` : ''
+
+  const paramValidation =
+    paramFields.length > 0
+      ? `
+    if (${paramFields.map((f) => `!${f}`).join(' || ')}) {
+      return res.status(200).json({ success: true, data: [], timestamp: Date.now() })
+    }`
+      : ''
+
+  const paramArray = paramFields.length > 0 ? `[${paramFields.join(', ')}]` : '[]'
+
+  const sslValue =
+    pgConfig.ssl === false
+      ? 'false'
+      : pgConfig.ssl === true || pgConfig.sslConfig
+      ? pgConfig.sslConfig
+        ? `{
+      ${pgConfig.sslConfig.ca ? `ca: ${replaceSecretReference(pgConfig.sslConfig.ca)},` : ''}
+      ${pgConfig.sslConfig.cert ? `cert: ${replaceSecretReference(pgConfig.sslConfig.cert)},` : ''}
+      ${pgConfig.sslConfig.key ? `key: ${replaceSecretReference(pgConfig.sslConfig.key)},` : ''}
+      rejectUnauthorized: false
+    }`
+        : '{ rejectUnauthorized: false }'
+      : 'false'
+
+  return `import { Client } from 'pg'
+
+const FORBIDDEN_KEYWORDS = ${JSON.stringify(FORBIDDEN_KEYWORDS)}
+
+const getClient = () => {
+  const connStr = process.env.TELEPORT_DB_CONNECTION_STRING
+  if (connStr) {
+    const sslEnv = process.env.TELEPORT_DB_SSL
+    const sslOpt = sslEnv === 'false' ? false : sslEnv === 'true' ? { rejectUnauthorized: false } : undefined
+    return new Client(Object.assign({ connectionString: connStr }, sslOpt !== undefined ? { ssl: sslOpt } : {}))
+  }
+  return new Client({
+    host: process.env.TELEPORT_DB_HOST || ${JSON.stringify(pgConfig.host ?? null)},
+    port: parseInt(process.env.TELEPORT_DB_PORT || '${pgConfig.port || 5432}', 10),
+    user: process.env.TELEPORT_DB_USER || ${JSON.stringify(
+      pgConfig.user ?? pgConfig.username ?? null
+    )},
+    password: process.env.TELEPORT_DB_PASSWORD || ${
+      replaceSecretReference(pgConfig.password) !== 'undefined'
+        ? replaceSecretReference(pgConfig.password)
+        : 'null'
+    },
+    database: process.env.TELEPORT_DB_NAME || ${JSON.stringify(pgConfig.database ?? null)},
+    ssl: ${sslValue}
+  })
+}
+
+const validateQuery = (query) => {
+  const trimmed = query.trim().toUpperCase()
+  for (const keyword of FORBIDDEN_KEYWORDS) {
+    if (trimmed.startsWith(keyword)) {
+      return false
+    }
+  }
+  return true
+}
+
+export default async function handler(req, res) {
+  try {
+    ${paramDestructure}
+    ${paramValidation}
+
+    const query = ${JSON.stringify(query)}
+
+    if (!validateQuery(query)) {
+      return res.status(400).json({
+        success: false,
+        error: 'Only SELECT queries are allowed',
+        timestamp: Date.now()
+      })
+    }
+
+    const client = getClient()
+    await client.connect()
+
+    try {
+      const result = await client.query(query, ${paramArray})
+
+      return res.status(200).json({
+        success: true,
+        data: result.rows,
+        timestamp: Date.now()
+      })
+    } finally {
+      await client.end()
+    }
+  } catch (error) {
+    console.error('Raw query fetch error:', error)
+    return res.status(500).json({
+      success: false,
+      error: error.message || 'Failed to fetch data',
+      timestamp: Date.now()
+    })
+  }
+}
+`
+}
+
+/**
+ * Parses a SQL query string for {{Current User.*}} template patterns.
+ * Returns the parameterized query and an ordered list of field names.
+ */
+export const parseQueryTemplateVariables = (
+  query: string
+): { parameterizedQuery: string; paramFields: string[] } => {
+  const captureRe = /\{\{Current User\.(\w+)\}\}/g
+  const paramFields: string[] = []
+
+  // First pass: collect unique fields in order
+  const tempRe = new RegExp(captureRe.source, 'g')
+  let match = tempRe.exec(query)
+  while (match !== null) {
+    const field = match[1]
+    if (!paramFields.includes(field)) {
+      paramFields.push(field)
+    }
+    match = tempRe.exec(query)
+  }
+
+  // Second pass: replace patterns with $N placeholders
+  let parameterizedQuery = query
+  for (let i = 0; i < paramFields.length; i++) {
+    const field = paramFields[i]
+    // Replace both quoted ('{{...}}') and unquoted ({{...}}) variants
+    const quotedPattern = `'{{Current User.${field}}}'`
+    const unquotedPattern = `{{Current User.${field}}}`
+
+    if (parameterizedQuery.includes(quotedPattern)) {
+      parameterizedQuery = parameterizedQuery.split(quotedPattern).join(`$${i + 1}`)
+    } else {
+      parameterizedQuery = parameterizedQuery.split(unquotedPattern).join(`$${i + 1}`)
+    }
+  }
+
+  // Convert field names to camelCase query param names
+  const queryParamNames = paramFields.map(
+    (f) => `currentUser${f.charAt(0).toUpperCase() + f.slice(1)}`
+  )
+
+  return { parameterizedQuery, paramFields: queryParamNames }
+}

package/src/fetchers/redis.ts

@@ -145,7 +145,7 @@ export default async function handler(req, res) {
       if (Array.isArray(parsedSorts) && parsedSorts.length > 0) {
         const primarySort = parsedSorts[0]
         if (primarySort.field) {
-          const sortOrderValue = primarySort.order?.toLowerCase() === 'desc' ? -1 : 1
+          const sortOrderValue = (primarySort.order || '').toLowerCase().startsWith('desc') ? -1 : 1
           results.sort((a, b) => {
             const aVal = a[primarySort.field]
             const bVal = b[primarySort.field]
@@ -156,7 +156,7 @@ export default async function handler(req, res) {
         }
       }
     } else if (sortBy) {
-      const sortOrderValue = sortOrder?.toLowerCase() === 'desc' ? -1 : 1
+      const sortOrderValue = (sortOrder || '').toLowerCase().startsWith('desc') ? -1 : 1
       results.sort((a, b) => {
         const aVal = a[sortBy]
         const bVal = b[sortBy]

package/src/fetchers/redshift.ts

@@ -2,6 +2,7 @@ import {
   replaceSecretReference,
   generateDateFormatterCode,
   generateSafeJSONParseCode,
+  generateSearchEscapeHelpersCode,
 } from '../utils'
 
 interface RedshiftConfig {
@@ -55,6 +56,8 @@ const getClient = () => {
 
 ${generateSafeJSONParseCode()}
 
+${generateSearchEscapeHelpersCode()}
+
 ${generateDateFormatterCode()}
 
 export default async function handler(req, res) {
@@ -95,13 +98,14 @@ export default async function handler(req, res) {
       }
       
       if (columns.length > 0) {
-        const searchConditions = columns.map((col) => {
-          const condition = \`\${col}::text ILIKE $\${paramIndex}\`
-          paramIndex++
-          return condition
-        })
-        columns.forEach(() => queryParams.push(\`%\${query}%\`))
-        conditions.push(\`(\${searchConditions.join(' OR ')})\`)
+        const pattern = '%' + escapeLikePattern(query) + '%'
+        const placeholder = '$' + paramIndex
+        paramIndex++
+        queryParams.push(pattern)
+        const searchConditions = columns.map(
+          (col) => '"' + sanitizeSearchIdentifier(col) + '"::text ILIKE ' + placeholder + " ESCAPE '|'"
+        )
+        conditions.push('(' + searchConditions.join(' OR ') + ')')
       }
     }
     
@@ -178,16 +182,16 @@ export default async function handler(req, res) {
       if (Array.isArray(parsedSorts) && parsedSorts.length > 0) {
         const orderClauses = parsedSorts.map((sort) => {
           if (!sort.field) return null
-          const order = sort.order?.toUpperCase() === 'DESC' ? 'DESC' : 'ASC'
+          const order = (sort.order || '').toUpperCase().startsWith('DESC') ? 'DESC' : 'ASC'
           return \`\${sanitizeIdentifier(sort.field)} \${order}\`
         }).filter(Boolean)
-        
+
         if (orderClauses.length > 0) {
           sql += \` ORDER BY \${orderClauses.join(', ')}\`
         }
       }
     } else if (sortBy) {
-      sql += \` ORDER BY \${sanitizeIdentifier(sortBy)} \${sortOrder?.toUpperCase() || 'ASC'}\`
+      sql += \` ORDER BY \${sanitizeIdentifier(sortBy)} \${(sortOrder || '').toUpperCase().startsWith('DESC') ? 'DESC' : 'ASC'}\`
     }
     
     const limitValue = limit || perPage

package/src/fetchers/rest-api.ts

@@ -207,7 +207,7 @@ export default async function handler(req, res) {
                 if (!sort.field) continue
                 const aVal = getNestedValue(a, sort.field)
                 const bVal = getNestedValue(b, sort.field)
-                const sortOrderValue = sort.order?.toLowerCase() === 'desc' ? -1 : 1
+                const sortOrderValue = (sort.order || '').toLowerCase().startsWith('desc') ? -1 : 1
                 
                 let comparison = 0
                 if (aVal === null || aVal === undefined) {
@@ -237,7 +237,7 @@ export default async function handler(req, res) {
         data.sort((a, b) => {
           const aVal = getNestedValue(a, sortBy)
           const bVal = getNestedValue(b, sortBy)
-          const sortOrderValue = sortOrder?.toLowerCase() === 'desc' ? -1 : 1
+          const sortOrderValue = (sortOrder || '').toLowerCase().startsWith('desc') ? -1 : 1
           
           let comparison = 0
           if (aVal === null || aVal === undefined) {

package/src/fetchers/supabase.ts

@@ -2,6 +2,7 @@ import {
   replaceSecretReference,
   generateDateFormatterCode,
   generateSafeJSONParseCode,
+  generateSearchEscapeHelpersCode,
 } from '../utils'
 
 export const validateSupabaseConfig = (
@@ -49,7 +50,66 @@ export const generateSupabaseFetcher = (
   const supabaseConfig = config as SupabaseConfig
   const supabaseUrl = supabaseConfig.supabaseUrl
   const apiKey = supabaseConfig.serviceRoleKey || supabaseConfig.publicApiKey
+  /*
+DO $$
+DECLARE
+    first_account_id UUID;
+    first_team_id UUID;
+BEGIN
+    -- Step 1: Select the first account's id
+    SELECT id INTO first_account_id
+    FROM accounts
+    ORDER BY id
+    LIMIT 1;
 
+    -- Step 2: Insert into subscriptions
+    INSERT INTO subscriptions (
+        "stripeSubscriptionId",
+        "accountId",
+        "stripeCurrentPeriodStart",
+        "stripeCurrentPeriodEnd",
+        "createdAt",
+        "updatedAt",
+        "percentOff"
+    ) VALUES (
+        'abc',
+        first_account_id,
+        '2025-08-13 00:00:00+00'::timestamptz,
+        '2035-09-13 00:00:00+00'::timestamptz,
+        '2025-08-13 00:00:00+00'::timestamptz,
+        '2025-08-13 00:00:00+00'::timestamptz,
+        100
+    );
+
+    -- Step 3: Insert into subscription-items
+    INSERT INTO "subscription-items" (
+        "stripeSubscriptionItemId",
+        "stripePriceId",
+        "stripeSubscriptionId",
+        "createdAt",
+        "updatedAt"
+    ) VALUES (
+        'abc',
+        'price_1KO3BuGd5V11xo4EFF8fKiVR',
+        'abc',
+        '2025-08-13 00:00:00+00'::timestamptz,
+        '2025-08-13 00:00:00+00'::timestamptz
+    );
+
+    -- Step 4: Get first team id and update its subscriptionItemId
+    SELECT id INTO first_team_id
+    FROM teams
+    ORDER BY id
+    LIMIT 1;
+
+    UPDATE teams
+    SET "subscriptionItemId" = 'abc'
+    WHERE id = first_team_id;
+
+    RAISE NOTICE 'Script completed successfully. Account ID: %, Team ID: %', first_account_id, first_team_id;
+END $$;
+
+*/
   return `import { createClient } from '@supabase/supabase-js'
 
 let client = null
@@ -67,6 +127,8 @@ const getClient = () => {
 
 ${generateSafeJSONParseCode()}
 
+${generateSearchEscapeHelpersCode()}
+
 // Helper function to process filter values
 const processFilterValue = (value) => {
   if (typeof value === 'string' && !isNaN(Number(value))) {
@@ -183,8 +245,10 @@ export default async function handler(req, res) {
       let columns = []
       
       if (queryColumns) {
-        // Use specified columns
-        columns = safeJSONParse(queryColumns)
+        // Use specified columns. Wrap non-arrays so a single column
+        // passed as a bare string doesn't get iterated as chars.
+        const parsed = safeJSONParse(queryColumns)
+        columns = Array.isArray(parsed) ? parsed : (parsed ? [parsed] : [])
       } else {
         // Fallback: Get text-searchable columns from a sample row
         try {
@@ -220,14 +284,26 @@ export default async function handler(req, res) {
       }
       
       if (columns.length > 0) {
-        const searchPattern = \`%\${query}%\`
-        // Note: Supabase PostgREST doesn't support ::text casting in .or() syntax
-        // Only text/varchar columns will match; non-text columns will be skipped
-        const orConditions = columns.map((col) => \`\${col}.ilike.\${searchPattern}\`).join(',')
+        // PostgREST .or() DSL separates conditions with comma and uses
+        // dot to split field / operator / value, so we wrap the pattern
+        // in double quotes and backslash-escape any embedded quotes or
+        // backslashes in the user's search term. Columns go through the
+        // shared identifier sanitizer to reject injection. Note:
+        // PostgREST .ilike. does not expose a LIKE ESCAPE clause, so
+        // raw % / _ in the user input still act as wildcards in this
+        // backend; the canvas preview path escapes them explicitly.
+        const rawPattern = "%" + String(query) + "%"
+        const escapedForPostgrest = rawPattern
+          .replace(/\\\\/g, "\\\\\\\\")
+          .replace(/"/g, '\\\\"')
+        const searchPattern = '"' + escapedForPostgrest + '"'
+        const orConditions = columns
+          .map((col) => sanitizeSearchIdentifier(col) + ".ilike." + searchPattern)
+          .join(",")
         queryRef = queryRef.or(orConditions)
       }
     }
-    
+
     // Apply filters using helper function
     queryRef = applyFilters(queryRef, filters)
     
@@ -237,14 +313,14 @@ export default async function handler(req, res) {
       if (Array.isArray(parsedSorts)) {
         parsedSorts.forEach((sort) => {
           if (sort.field) {
-            queryRef = queryRef.order(sort.field, { 
-              ascending: sort.order?.toLowerCase() !== 'desc' 
+            queryRef = queryRef.order(sort.field, {
+              ascending: !(sort.order || '').toLowerCase().startsWith('desc')
             })
           }
         })
       }
     } else if (sortBy) {
-      queryRef = queryRef.order(sortBy, { ascending: sortOrder !== 'desc' })
+      queryRef = queryRef.order(sortBy, { ascending: !(sortOrder || '').toLowerCase().startsWith('desc') })
     }
     
     const limitValue = limit || perPage
@@ -337,10 +413,17 @@ async function getCount(req, res) {
       }
       
       if (columns.length > 0) {
-        const searchPattern = \`%\${query}%\`
-        // Note: Supabase PostgREST doesn't support ::text casting in .or() syntax
-        // Only text/varchar columns will match; non-text columns will be skipped
-        const orConditions = columns.map((col) => \`\${col}.ilike.\${searchPattern}\`).join(',')
+        // Mirror the fetch handler: sanitize identifiers, wrap the
+        // pattern in double quotes for PostgREST .or() DSL, and escape
+        // backslashes / quotes in the user's search term.
+        const rawPattern = "%" + String(query) + "%"
+        const escapedForPostgrest = rawPattern
+          .replace(/\\\\/g, "\\\\\\\\")
+          .replace(/"/g, '\\\\"')
+        const searchPattern = '"' + escapedForPostgrest + '"'
+        const orConditions = columns
+          .map((col) => sanitizeSearchIdentifier(col) + ".ilike." + searchPattern)
+          .join(",")
         countQuery = countQuery.or(orConditions)
       }
     }