@teleporthq/teleport-plugin-next-data-source 0.42.8 → 0.42.10

package/src/fetchers/static-collection.ts

@@ -1,3 +1,9 @@
+import {
+  generateDateFormatterCode,
+  generateSortFilterHelperCode,
+  generateSafeJSONParseCode,
+} from '../utils'
+
 export const validateStaticCollectionConfig = (
   config: Record<string, unknown>
 ): { isValid: boolean; error?: string } => {
@@ -20,9 +26,15 @@ export const generateStaticCollectionFetcher = (config: Record<string, unknown>)
   const staticConfig = config as StaticCollectionConfig
   return `const data = ${JSON.stringify(staticConfig.data || [])}
 
+${generateSafeJSONParseCode()}
+
+${generateDateFormatterCode()}
+
+${generateSortFilterHelperCode()}
+
 export default async function handler(req, res) {
   try {
-    const { query, queryColumns, limit, page, perPage, sortBy, sortOrder, filters, offset: offsetParam } = req.query
+    const { query, queryColumns, limit, page, perPage, sortBy, sortOrder, filters, sorts, offset: offsetParam } = req.query
     
     let filteredData = [...data]
     
@@ -30,10 +42,10 @@ export default async function handler(req, res) {
       const searchQuery = query.toLowerCase()
       
       if (queryColumns) {
-        const columns = JSON.parse(queryColumns)
+        const columns = safeJSONParse(queryColumns)
         filteredData = filteredData.filter((item) => {
           return columns.some((col) => {
-            const value = item[col]
+            const value = getNestedValue(item, col)
             return value && String(value).toLowerCase().includes(searchQuery)
           })
         })
@@ -50,25 +62,95 @@ export default async function handler(req, res) {
     }
     
     if (filters) {
-      const parsedFilters = JSON.parse(filters)
-      filteredData = filteredData.filter((item) => {
-        return Object.entries(parsedFilters).every(([key, value]) => {
-          if (Array.isArray(value)) {
-            return value.includes(item[key])
-          }
-          return item[key] === value
+      const parsedFilters = safeJSONParse(filters)
+      
+      if (Array.isArray(parsedFilters)) {
+        filteredData = filteredData.filter((item) => {
+          return parsedFilters.every((filter) => {
+            if (!filter.source || filter.destination === undefined) return true
+            
+            const field = filter.source
+            const value = getNestedValue(item, field)
+            const target = filter.destination
+            const operand = filter.operand || '='
+            
+            if (Array.isArray(target)) {
+              if (operand === '!=') {
+                return !target.includes(value)
+              }
+              return target.includes(value)
+            }
+            
+            return compareValues(value, target, operand)
+          })
         })
-      })
+      } else {
+        filteredData = filteredData.filter((item) => {
+          return Object.entries(parsedFilters).every(([key, value]) => {
+            const itemValue = getNestedValue(item, key)
+            if (Array.isArray(value)) {
+              return value.includes(itemValue)
+            }
+            return compareValues(itemValue, value, '=')
+          })
+        })
+      }
     }
     
-    if (sortBy) {
+    if (sorts) {
+      const parsedSorts = safeJSONParse(sorts)
+      if (Array.isArray(parsedSorts) && parsedSorts.length > 0) {
+        filteredData.sort((a, b) => {
+          for (const sort of parsedSorts) {
+            if (!sort.field) continue
+            const aVal = getNestedValue(a, sort.field)
+            const bVal = getNestedValue(b, sort.field)
+            const sortOrderValue = sort.order?.toLowerCase() === 'desc' ? -1 : 1
+            
+            let comparison = 0
+            if (aVal === null || aVal === undefined) {
+              comparison = bVal === null || bVal === undefined ? 0 : -1
+            } else if (bVal === null || bVal === undefined) {
+              comparison = 1
+            } else if (typeof aVal === 'number' && typeof bVal === 'number') {
+              comparison = aVal - bVal
+            } else if (aVal instanceof Date && bVal instanceof Date) {
+              comparison = aVal.getTime() - bVal.getTime()
+            } else {
+              const aStr = String(aVal)
+              const bStr = String(bVal)
+              if (aStr < bStr) comparison = -1
+              else if (aStr > bStr) comparison = 1
+            }
+            
+            if (comparison !== 0) return comparison * sortOrderValue
+          }
+          return 0
+        })
+      }
+    } else if (sortBy) {
       filteredData.sort((a, b) => {
-        const aVal = a[sortBy]
-        const bVal = b[sortBy]
+        const aVal = getNestedValue(a, sortBy)
+        const bVal = getNestedValue(b, sortBy)
         const sortOrderValue = sortOrder?.toLowerCase() === 'desc' ? -1 : 1
-        if (aVal < bVal) return -sortOrderValue
-        if (aVal > bVal) return sortOrderValue
-        return 0
+        
+        let comparison = 0
+        if (aVal === null || aVal === undefined) {
+          comparison = bVal === null || bVal === undefined ? 0 : -1
+        } else if (bVal === null || bVal === undefined) {
+          comparison = 1
+        } else if (typeof aVal === 'number' && typeof bVal === 'number') {
+          comparison = aVal - bVal
+        } else if (aVal instanceof Date && bVal instanceof Date) {
+          comparison = aVal.getTime() - bVal.getTime()
+        } else {
+          const aStr = String(aVal)
+          const bStr = String(bVal)
+          if (aStr < bStr) comparison = -1
+          else if (aStr > bStr) comparison = 1
+        }
+        
+        return comparison * sortOrderValue
       })
     }
     
@@ -79,7 +161,7 @@ export default async function handler(req, res) {
       filteredData = filteredData.slice(offsetValue, offsetValue + parseInt(limitValue))
     }
     
-    const safeData = JSON.parse(JSON.stringify(filteredData))
+    const safeData = JSON.parse(JSON.stringify(filteredData, dateReplacer))
     
     return res.status(200).json({
       success: true,

package/src/fetchers/supabase.ts

@@ -1,4 +1,8 @@
-import { replaceSecretReference } from '../utils'
+import {
+  replaceSecretReference,
+  generateDateFormatterCode,
+  generateSafeJSONParseCode,
+} from '../utils'
 
 export const validateSupabaseConfig = (
   config: Record<string, unknown>
@@ -61,10 +65,117 @@ const getClient = () => {
   return client
 }
 
+${generateSafeJSONParseCode()}
+
+// Helper function to process filter values
+const processFilterValue = (value) => {
+  if (typeof value === 'string' && !isNaN(Number(value))) {
+    return Number(value)
+  }
+  return value
+}
+
+// Helper function to apply filters to a query
+const applyFilters = (queryRef, filters) => {
+  if (!filters) return queryRef
+  
+  const parsedFilters = safeJSONParse(filters)
+  
+  if (Array.isArray(parsedFilters)) {
+    parsedFilters.forEach((filter) => {
+      if (!filter.source || filter.destination === undefined) return
+      
+      const field = filter.source
+      const value = filter.destination
+      const operand = filter.operand || '='
+      
+      if (Array.isArray(value)) {
+        const processedValues = value.map(processFilterValue)
+        if (operand === '!=') {
+          queryRef = queryRef.not(field, 'in', processedValues)
+        } else {
+          queryRef = queryRef.in(field, processedValues)
+        }
+      } else {
+        const processedValue = processFilterValue(value)
+        
+        // Handle null values
+        if (processedValue === null) {
+          if (operand === '=') {
+            queryRef = queryRef.is(field, null)
+          } else if (operand === '!=') {
+            queryRef = queryRef.not(field, 'is', null)
+          }
+        } else {
+          // Map operand to Supabase methods
+          switch (operand) {
+            case '=':
+              queryRef = queryRef.eq(field, processedValue)
+              break
+            case '!=':
+              queryRef = queryRef.neq(field, processedValue)
+              break
+            case '>':
+              queryRef = queryRef.gt(field, processedValue)
+              break
+            case '>=':
+              queryRef = queryRef.gte(field, processedValue)
+              break
+            case '<':
+              queryRef = queryRef.lt(field, processedValue)
+              break
+            case '<=':
+              queryRef = queryRef.lte(field, processedValue)
+              break
+            default:
+              queryRef = queryRef.eq(field, processedValue)
+          }
+        }
+      }
+    })
+  } else {
+    // Old format: object with key-value pairs (backward compatibility)
+    Object.entries(parsedFilters).forEach(([key, value]) => {
+      if (Array.isArray(value)) {
+        const processedValues = value.map(processFilterValue)
+        queryRef = queryRef.in(key, processedValues)
+      } else if (typeof value === 'object' && value !== null) {
+        const operator = Object.keys(value)[0]
+        let operatorValue = value[operator]
+        if (typeof operatorValue === 'string' && !isNaN(Number(operatorValue))) {
+          operatorValue = Number(operatorValue)
+        }
+        switch (operator) {
+          case 'eq': queryRef = queryRef.eq(key, operatorValue); break
+          case 'neq': queryRef = queryRef.neq(key, operatorValue); break
+          case 'gt': queryRef = queryRef.gt(key, operatorValue); break
+          case 'gte': queryRef = queryRef.gte(key, operatorValue); break
+          case 'lt': queryRef = queryRef.lt(key, operatorValue); break
+          case 'lte': queryRef = queryRef.lte(key, operatorValue); break
+          case 'like': queryRef = queryRef.like(key, operatorValue); break
+          case 'ilike': queryRef = queryRef.ilike(key, operatorValue); break
+          case 'in': queryRef = queryRef.in(key, operatorValue); break
+          default: queryRef = queryRef.eq(key, operatorValue)
+        }
+      } else {
+        let processedValue = value
+        if (typeof value === 'string' && !isNaN(Number(value))) {
+          processedValue = Number(value)
+        }
+        queryRef = queryRef.eq(key, processedValue)
+      }
+    })
+  }
+  
+  return queryRef
+}
+
+${generateDateFormatterCode()}
+
 export default async function handler(req, res) {
   try {
     const client = getClient()
-    const { query, queryColumns, select, limit, page, perPage, sortBy, sortOrder, filters, offset } = req.query
+    const { query, queryColumns, select, limit, page, perPage, sortBy, sortOrder, filters, sorts, offset } = req.query
     
     let queryRef = client.from('${tableName}').select(select || '*')
     
@@ -73,16 +184,34 @@ export default async function handler(req, res) {
       
       if (queryColumns) {
         // Use specified columns
-        columns = JSON.parse(queryColumns)
+        columns = safeJSONParse(queryColumns)
       } else {
-        // Fallback: Get all column names from a sample row
+        // Fallback: Get text-searchable columns from a sample row
         try {
           const { data: sampleData, error: sampleError } = await client.from('${tableName}').select('*').limit(1).single()
           if (sampleError) {
             throw sampleError
           }
           if (sampleData) {
-            columns = Object.keys(sampleData)
+            // Filter out columns that are likely non-text types
+            // Note: This is heuristic-based since we don't have schema info
+            columns = Object.keys(sampleData).filter(col => {
+              const value = sampleData[col]
+              const colLower = col.toLowerCase()
+              
+              // Exclude common timestamp/date column names
+              if (colLower.includes('_at') || colLower.includes('date') || colLower === 'timestamp') {
+                return false
+              }
+              
+              // Exclude if value is a number, boolean, null, or object (non-string)
+              if (value === null || value === undefined) {
+                return true // Include null columns, let the query handle it
+              }
+              
+              const type = typeof value
+              return type === 'string' // Only include string values
+            })
           }
         } catch (schemaError) {
           console.warn('Failed to fetch sample row for column names:', schemaError.message)
@@ -92,51 +221,29 @@ export default async function handler(req, res) {
       
       if (columns.length > 0) {
         const searchPattern = \`%\${query}%\`
+        // Note: Supabase PostgREST doesn't support ::text casting in .or() syntax
+        // Only text/varchar columns will match; non-text columns will be skipped
         const orConditions = columns.map((col) => \`\${col}.ilike.\${searchPattern}\`).join(',')
         queryRef = queryRef.or(orConditions)
       }
     }
     
-    if (filters) {
-      const parsedFilters = JSON.parse(filters)
-      Object.entries(parsedFilters).forEach(([key, value]) => {
-        if (Array.isArray(value)) {
-          const processedValues = value.map((v) => {
-            if (typeof v === 'string' && !isNaN(Number(v))) {
-              return Number(v)
-            }
-            return v
-          })
-          queryRef = queryRef.in(key, processedValues)
-        } else if (typeof value === 'object' && value !== null) {
-          const operator = Object.keys(value)[0]
-          let operatorValue = value[operator]
-          if (typeof operatorValue === 'string' && !isNaN(Number(operatorValue))) {
-            operatorValue = Number(operatorValue)
-          }
-          switch (operator) {
-            case 'eq': queryRef = queryRef.eq(key, operatorValue); break
-            case 'neq': queryRef = queryRef.neq(key, operatorValue); break
-            case 'gt': queryRef = queryRef.gt(key, operatorValue); break
-            case 'gte': queryRef = queryRef.gte(key, operatorValue); break
-            case 'lt': queryRef = queryRef.lt(key, operatorValue); break
-            case 'lte': queryRef = queryRef.lte(key, operatorValue); break
-            case 'like': queryRef = queryRef.like(key, operatorValue); break
-            case 'ilike': queryRef = queryRef.ilike(key, operatorValue); break
-            case 'in': queryRef = queryRef.in(key, operatorValue); break
-            default: queryRef = queryRef.eq(key, operatorValue)
-          }
-        } else {
-          let processedValue = value
-          if (typeof value === 'string' && !isNaN(Number(value))) {
-            processedValue = Number(value)
-          }
-          queryRef = queryRef.eq(key, processedValue)
-        }
-      })
-    }
+    // Apply filters using helper function
+    queryRef = applyFilters(queryRef, filters)
     
-    if (sortBy) {
+    // Handle sorts - new array format
+    if (sorts) {
+      const parsedSorts = safeJSONParse(sorts)
+      if (Array.isArray(parsedSorts)) {
+        parsedSorts.forEach((sort) => {
+          if (sort.field) {
+            queryRef = queryRef.order(sort.field, { 
+              ascending: sort.order?.toLowerCase() !== 'desc' 
+            })
+          }
+        })
+      }
+    } else if (sortBy) {
       queryRef = queryRef.order(sortBy, { ascending: sortOrder !== 'desc' })
     }
     
@@ -159,7 +266,7 @@ export default async function handler(req, res) {
       })
     }
     
-    const safeData = JSON.parse(JSON.stringify(data))
+    const safeData = JSON.parse(JSON.stringify(data, dateReplacer))
     
     return res.status(200).json({
       success: true,
@@ -193,16 +300,35 @@ async function getCount(req, res) {
       
       if (queryColumns) {
         // Use specified columns
-        columns = typeof queryColumns === 'string' ? JSON.parse(queryColumns) : (Array.isArray(queryColumns) ? queryColumns : [queryColumns])
+        const parsed = safeJSONParse(queryColumns)
+        columns = Array.isArray(parsed) ? parsed : [parsed]
       } else {
-        // Fallback: Get all column names from a sample row
+        // Fallback: Get text-searchable columns from a sample row
         try {
           const { data: sampleData, error: sampleError } = await supabase.from('${tableName}').select('*').limit(1).single()
           if (sampleError) {
             throw sampleError
           }
           if (sampleData) {
-            columns = Object.keys(sampleData)
+            // Filter out columns that are likely non-text types
+            // Note: This is heuristic-based since we don't have schema info
+            columns = Object.keys(sampleData).filter(col => {
+              const value = sampleData[col]
+              const colLower = col.toLowerCase()
+              
+              // Exclude common timestamp/date column names
+              if (colLower.includes('_at') || colLower.includes('date') || colLower === 'timestamp') {
+                return false
+              }
+              
+              // Exclude if value is a number, boolean, null, or object (non-string)
+              if (value === null || value === undefined) {
+                return true // Include null columns, let the query handle it
+              }
+              
+              const type = typeof value
+              return type === 'string' // Only include string values
+            })
           }
         } catch (schemaError) {
           console.warn('Failed to fetch sample row for column names:', schemaError.message)
@@ -212,17 +338,15 @@ async function getCount(req, res) {
       
       if (columns.length > 0) {
         const searchPattern = \`%\${query}%\`
+        // Note: Supabase PostgREST doesn't support ::text casting in .or() syntax
+        // Only text/varchar columns will match; non-text columns will be skipped
         const orConditions = columns.map((col) => \`\${col}.ilike.\${searchPattern}\`).join(',')
         countQuery = countQuery.or(orConditions)
       }
     }
 
-    if (filters) {
-      const parsedFilters = JSON.parse(filters)
-      for (const filter of parsedFilters) {
-        countQuery = countQuery.eq(filter.column, filter.value)
-      }
-    }
+    // Apply filters using helper function
+    countQuery = applyFilters(countQuery, filters)
 
     const { count, error } = await countQuery
     

package/src/fetchers/turso.ts

@@ -1,4 +1,8 @@
-import { replaceSecretReference } from '../utils'
+import {
+  replaceSecretReference,
+  generateDateFormatterCode,
+  generateSafeJSONParseCode,
+} from '../utils'
 
 export const validateTursoConfig = (
   config: Record<string, unknown>
@@ -35,6 +39,10 @@ export const generateTursoFetcher = (
 
   return `import { createClient } from '@libsql/client'
 
+${generateSafeJSONParseCode()}
+
+${generateDateFormatterCode()}
+
 export default async function handler(req, res) {
   let client = null
   try {
@@ -43,7 +51,7 @@ export default async function handler(req, res) {
       authToken: ${replaceSecretReference(token)}
     })
     
-    const { query, queryColumns, limit, page, perPage, sortBy, sortOrder, filters, offset } = req.query
+    const { query, queryColumns, limit, page, perPage, sortBy, sortOrder, filters, sorts, offset } = req.query
     
     let sql = \`SELECT * FROM ${tableName}\`
     const whereClauses = []
@@ -52,8 +60,10 @@ export default async function handler(req, res) {
     
     if (query) {
       if (queryColumns) {
-        const columns = typeof queryColumns === 'string' ? JSON.parse(queryColumns) : (Array.isArray(queryColumns) ? queryColumns : [queryColumns])
-        const searchConditions = columns.map((col) => \`\${col} LIKE ?\`)
+        const parsed = safeJSONParse(queryColumns)
+        const columns = Array.isArray(parsed) ? parsed : [parsed]
+        // Cast columns to TEXT to support searching on non-text columns (dates, numbers, etc.)
+        const searchConditions = columns.map((col) => \`CAST(\${col} AS TEXT) LIKE ?\`)
         whereClauses.push(\`(\${searchConditions.join(' OR ')})\`)
         columns.forEach(() => {
           queryParams.push(\`%\${query}%\`)
@@ -64,27 +74,86 @@ export default async function handler(req, res) {
       }
     }
     
+    // Helper to sanitize identifier (prevent SQL injection in column names)
+    const sanitizeIdentifier = (name) => {
+      // Only allow alphanumeric and underscore
+      if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(name)) {
+        throw new Error(\`Invalid identifier: \${name}\`)
+      }
+      return \`"\${name}"\`
+    }
+    
     if (filters) {
-      const parsedFilters = JSON.parse(filters)
-      Object.entries(parsedFilters).forEach(([key, value]) => {
-        if (Array.isArray(value)) {
-          const placeholders = value.map(() => '?').join(', ')
-          queryParams.push(...value)
-          whereClauses.push(\`\${key} IN (\${placeholders})\`)
-        } else {
-          whereClauses.push(\`\${key} = ?\`)
-          queryParams.push(value)
-        }
-      })
+      const parsedFilters = safeJSONParse(filters)
+      
+      if (Array.isArray(parsedFilters)) {
+        parsedFilters.forEach((filter) => {
+          if (!filter.source || filter.destination === undefined) return
+          
+          const field = sanitizeIdentifier(filter.source)
+          const value = filter.destination
+          const operand = filter.operand || '='
+          
+          if (Array.isArray(value)) {
+            if (value.length === 0) return
+            const placeholders = value.map(() => '?').join(', ')
+            queryParams.push(...value)
+            if (operand === '!=') {
+              whereClauses.push(\`\${field} NOT IN (\${placeholders})\`)
+            } else {
+              whereClauses.push(\`\${field} IN (\${placeholders})\`)
+            }
+          } else {
+            if (value === null) {
+              if (operand === '=') {
+                whereClauses.push(\`\${field} IS NULL\`)
+              } else if (operand === '!=') {
+                whereClauses.push(\`\${field} IS NOT NULL\`)
+              }
+            } else {
+              const validOps = ['=', '!=', '>', '<', '>=', '<=']
+              const sqlOperator = validOps.includes(operand) ? operand : '='
+              whereClauses.push(\`\${field} \${sqlOperator} ?\`)
+              queryParams.push(value)
+            }
+          }
+        })
+      } else {
+        Object.entries(parsedFilters).forEach(([key, value]) => {
+          const field = sanitizeIdentifier(key)
+          if (Array.isArray(value)) {
+            const placeholders = value.map(() => '?').join(', ')
+            queryParams.push(...value)
+            whereClauses.push(\`\${field} IN (\${placeholders})\`)
+          } else {
+            whereClauses.push(\`\${field} = ?\`)
+            queryParams.push(value)
+          }
+        })
+      }
     }
     
     if (whereClauses.length > 0) {
       sql += \` WHERE \${whereClauses.join(' AND ')}\`
     }
     
-    if (sortBy) {
+    // Handle sorts - new array format
+    if (sorts) {
+      const parsedSorts = safeJSONParse(sorts)
+      if (Array.isArray(parsedSorts) && parsedSorts.length > 0) {
+        const orderClauses = parsedSorts.map((sort) => {
+          if (!sort.field) return null
+          const order = sort.order?.toUpperCase() === 'DESC' ? 'DESC' : 'ASC'
+          return \`\${sanitizeIdentifier(sort.field)} \${order}\`
+        }).filter(Boolean)
+        
+        if (orderClauses.length > 0) {
+          sql += \` ORDER BY \${orderClauses.join(', ')}\`
+        }
+      }
+    } else if (sortBy) {
       const sortOrderValue = sortOrder?.toUpperCase() === 'DESC' ? 'DESC' : 'ASC'
-      sql += \` ORDER BY \${sortBy} \${sortOrderValue}\`
+      sql += \` ORDER BY \${sanitizeIdentifier(sortBy)} \${sortOrderValue}\`
     }
     
     const limitValue = limit || perPage
@@ -137,7 +206,7 @@ export default async function handler(req, res) {
       }
     }
     
-    const safeData = JSON.parse(JSON.stringify(data))
+    const safeData = JSON.parse(JSON.stringify(data, dateReplacer))
     
     return res.status(200).json({
       success: true,