@teleporthq/teleport-plugin-next-data-source 0.42.9 → 0.42.11

package/src/fetchers/redshift.ts

@@ -1,4 +1,8 @@
-import { replaceSecretReference, generateDateFormatterCode } from '../utils'
+import {
+  replaceSecretReference,
+  generateDateFormatterCode,
+  generateSafeJSONParseCode,
+} from '../utils'
 
 interface RedshiftConfig {
   host?: string
@@ -49,6 +53,8 @@ const getClient = () => {
   })
 }
 
+${generateSafeJSONParseCode()}
+
 ${generateDateFormatterCode()}
 
 export default async function handler(req, res) {
@@ -58,7 +64,7 @@ export default async function handler(req, res) {
     await client.connect()
     ${schema ? `await client.query('SET search_path TO ${schema}')` : ''}
     
-    const { query, queryColumns, limit, page, perPage, sortBy, sortOrder, filters, offset } = req.query
+    const { query, queryColumns, limit, page, perPage, sortBy, sortOrder, filters, sorts, offset } = req.query
     
     const conditions = []
     const queryParams = []
@@ -68,7 +74,8 @@ export default async function handler(req, res) {
       let columns = []
       
       if (queryColumns) {
-        columns = typeof queryColumns === 'string' ? JSON.parse(queryColumns) : (Array.isArray(queryColumns) ? queryColumns : [queryColumns])
+        const parsed = safeJSONParse(queryColumns)
+        columns = Array.isArray(parsed) ? parsed : [parsed]
       } else {
         // Fallback: Get all columns from information_schema
         try {
@@ -98,19 +105,65 @@ export default async function handler(req, res) {
       }
     }
     
+    // Helper to sanitize identifier (prevent SQL injection in column names)
+    const sanitizeIdentifier = (name) => {
+      // Only allow alphanumeric, underscore, and dot (for schema.table)
+      if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(name)) {
+        throw new Error(\`Invalid identifier: \${name}\`)
+      }
+      return \`"\${name}"\`
+    }
+    
     if (filters) {
-      const parsedFilters = JSON.parse(filters)
-      Object.entries(parsedFilters).forEach(([key, value]) => {
-        if (Array.isArray(value)) {
-          const placeholders = value.map(() => \`$\${paramIndex++}\`)
-          queryParams.push(...value)
-          conditions.push(\`\${key} IN (\${placeholders.join(', ')})\`)
-        } else {
-          conditions.push(\`\${key} = $\${paramIndex}\`)
-          queryParams.push(value)
-          paramIndex++
-        }
-      })
+      const parsedFilters = safeJSONParse(filters)
+      
+      if (Array.isArray(parsedFilters)) {
+        parsedFilters.forEach((filter) => {
+          if (!filter.source || filter.destination === undefined) return
+          
+          const field = sanitizeIdentifier(filter.source)
+          const value = filter.destination
+          const operand = filter.operand || '='
+          
+          if (Array.isArray(value)) {
+            if (value.length === 0) return
+            const placeholders = value.map(() => \`$\${paramIndex++}\`)
+            queryParams.push(...value)
+            if (operand === '!=') {
+              conditions.push(\`\${field} NOT IN (\${placeholders.join(', ')})\`)
+            } else {
+              conditions.push(\`\${field} IN (\${placeholders.join(', ')})\`)
+            }
+          } else {
+            if (value === null) {
+              if (operand === '=') {
+                conditions.push(\`\${field} IS NULL\`)
+              } else if (operand === '!=') {
+                conditions.push(\`\${field} IS NOT NULL\`)
+              }
+            } else {
+              const validOps = ['=', '!=', '>', '<', '>=', '<=']
+              const sqlOperator = validOps.includes(operand) ? operand : '='
+              conditions.push(\`\${field} \${sqlOperator} $\${paramIndex}\`)
+              queryParams.push(value)
+              paramIndex++
+            }
+          }
+        })
+      } else {
+        Object.entries(parsedFilters).forEach(([key, value]) => {
+          const field = sanitizeIdentifier(key)
+          if (Array.isArray(value)) {
+            const placeholders = value.map(() => \`$\${paramIndex++}\`)
+            queryParams.push(...value)
+            conditions.push(\`\${field} IN (\${placeholders.join(', ')})\`)
+          } else {
+            conditions.push(\`\${field} = $\${paramIndex}\`)
+            queryParams.push(value)
+            paramIndex++
+          }
+        })
+      }
     }
     
     let sql = \`SELECT * FROM ${tableName}\`
@@ -119,8 +172,22 @@ export default async function handler(req, res) {
       sql += \` WHERE \${conditions.join(' AND ')}\`
     }
     
-    if (sortBy) {
-      sql += \` ORDER BY \${sortBy} \${sortOrder?.toUpperCase() || 'ASC'}\`
+    // Handle sorts - new array format
+    if (sorts) {
+      const parsedSorts = safeJSONParse(sorts)
+      if (Array.isArray(parsedSorts) && parsedSorts.length > 0) {
+        const orderClauses = parsedSorts.map((sort) => {
+          if (!sort.field) return null
+          const order = sort.order?.toUpperCase() === 'DESC' ? 'DESC' : 'ASC'
+          return \`\${sanitizeIdentifier(sort.field)} \${order}\`
+        }).filter(Boolean)
+        
+        if (orderClauses.length > 0) {
+          sql += \` ORDER BY \${orderClauses.join(', ')}\`
+        }
+      }
+    } else if (sortBy) {
+      sql += \` ORDER BY \${sanitizeIdentifier(sortBy)} \${sortOrder?.toUpperCase() || 'ASC'}\`
     }
     
     const limitValue = limit || perPage

package/src/fetchers/rest-api.ts

@@ -1,4 +1,8 @@
-import { generateDateFormatterCode } from '../utils'
+import {
+  generateDateFormatterCode,
+  generateSortFilterHelperCode,
+  generateSafeJSONParseCode,
+} from '../utils'
 
 export const validateRESTAPIConfig = (
   config: Record<string, unknown>
@@ -77,11 +81,15 @@ export const generateRESTAPIFetcher = (config: Record<string, unknown>): string
 
   return `import fetch from 'node-fetch'
 
+${generateSafeJSONParseCode()}
+
 ${generateDateFormatterCode()}
 
+${generateSortFilterHelperCode()}
+
 export default async function handler(req, res) {
   try {
-    const { query, queryColumns, limit, page, perPage, sortBy, sortOrder, filters, offset } = req.query
+    const { query, queryColumns, limit, page, perPage, sortBy, sortOrder, filters, sorts, offset } = req.query
     
     const url = ${JSON.stringify(restConfig.url)}
     const method = ${JSON.stringify(restConfig.method || 'GET')}
@@ -120,18 +128,17 @@ export default async function handler(req, res) {
     
     let data = await response.json()
     
-    // Apply filtering, sorting, and pagination if data is an array
     if (Array.isArray(data)) {
-      // 1. Apply search filter
       if (query && query.trim()) {
         const searchQuery = query.toLowerCase()
         
         if (queryColumns) {
           try {
-            const columns = typeof queryColumns === 'string' ? JSON.parse(queryColumns) : (Array.isArray(queryColumns) ? queryColumns : [queryColumns])
+            const parsed = safeJSONParse(queryColumns)
+            const columns = Array.isArray(parsed) ? parsed : [parsed]
             data = data.filter((item) => {
               return columns.some((col) => {
-                const value = item[col]
+                const value = getNestedValue(item, col)
                 if (value === null || value === undefined) return false
                 return String(value).toLowerCase().includes(searchQuery)
               })
@@ -140,7 +147,6 @@ export default async function handler(req, res) {
             console.error('Error parsing queryColumns:', err)
           }
         } else {
-          // Search across all fields
           data = data.filter((item) => {
             try {
               const stringified = JSON.stringify(item).toLowerCase()
@@ -152,36 +158,107 @@ export default async function handler(req, res) {
         }
       }
       
-      // 2. Apply custom filters
       if (filters) {
         try {
-          const parsedFilters = typeof filters === 'string' ? JSON.parse(filters) : filters
-          data = data.filter((item) => {
-            return Object.entries(parsedFilters).every(([key, value]) => {
-              if (Array.isArray(value)) {
-                return value.includes(item[key])
-              }
-              return item[key] === value
+          const parsedFilters = safeJSONParse(filters)
+          
+          if (Array.isArray(parsedFilters)) {
+            data = data.filter((item) => {
+              return parsedFilters.every((filter) => {
+                if (!filter.source || filter.destination === undefined) return true
+                
+                const field = filter.source
+                const value = getNestedValue(item, field)
+                const target = filter.destination
+                const operand = filter.operand || '='
+                
+                if (Array.isArray(target)) {
+                  if (operand === '!=') {
+                    return !target.includes(value)
+                  }
+                  return target.includes(value)
+                }
+                
+                return compareValues(value, target, operand)
+              })
             })
-          })
+          } else {
+            data = data.filter((item) => {
+              return Object.entries(parsedFilters).every(([key, value]) => {
+                const itemValue = getNestedValue(item, key)
+                if (Array.isArray(value)) {
+                  return value.includes(itemValue)
+                }
+                return compareValues(itemValue, value, '=')
+              })
+            })
+          }
         } catch (err) {
           console.error('Error parsing filters:', err)
         }
       }
       
-      // 3. Apply sorting
-      if (sortBy && sortBy.trim()) {
+      if (sorts) {
+        try {
+          const parsedSorts = safeJSONParse(sorts)
+          if (Array.isArray(parsedSorts) && parsedSorts.length > 0) {
+            data.sort((a, b) => {
+              for (const sort of parsedSorts) {
+                if (!sort.field) continue
+                const aVal = getNestedValue(a, sort.field)
+                const bVal = getNestedValue(b, sort.field)
+                const sortOrderValue = sort.order?.toLowerCase() === 'desc' ? -1 : 1
+                
+                let comparison = 0
+                if (aVal === null || aVal === undefined) {
+                  comparison = bVal === null || bVal === undefined ? 0 : -1
+                } else if (bVal === null || bVal === undefined) {
+                  comparison = 1
+                } else if (typeof aVal === 'number' && typeof bVal === 'number') {
+                  comparison = aVal - bVal
+                } else if (aVal instanceof Date && bVal instanceof Date) {
+                  comparison = aVal.getTime() - bVal.getTime()
+                } else {
+                  const aStr = String(aVal)
+                  const bStr = String(bVal)
+                  if (aStr < bStr) comparison = -1
+                  else if (aStr > bStr) comparison = 1
+                }
+                
+                if (comparison !== 0) return comparison * sortOrderValue
+              }
+              return 0
+            })
+          }
+        } catch (err) {
+          console.error('Error parsing sorts:', err)
+        }
+      } else if (sortBy && sortBy.trim()) {
         data.sort((a, b) => {
-          const aVal = a[sortBy]
-          const bVal = b[sortBy]
+          const aVal = getNestedValue(a, sortBy)
+          const bVal = getNestedValue(b, sortBy)
           const sortOrderValue = sortOrder?.toLowerCase() === 'desc' ? -1 : 1
-          if (aVal < bVal) return -sortOrderValue
-          if (aVal > bVal) return sortOrderValue
-          return 0
+          
+          let comparison = 0
+          if (aVal === null || aVal === undefined) {
+            comparison = bVal === null || bVal === undefined ? 0 : -1
+          } else if (bVal === null || bVal === undefined) {
+            comparison = 1
+          } else if (typeof aVal === 'number' && typeof bVal === 'number') {
+            comparison = aVal - bVal
+          } else if (aVal instanceof Date && bVal instanceof Date) {
+            comparison = aVal.getTime() - bVal.getTime()
+          } else {
+            const aStr = String(aVal)
+            const bStr = String(bVal)
+            if (aStr < bStr) comparison = -1
+            else if (aStr > bStr) comparison = 1
+          }
+          
+          return comparison * sortOrderValue
         })
       }
       
-      // 4. Apply pagination
       const limitValue = limit || perPage
       const pageValue = page ? Math.max(1, parseInt(page)) : undefined
       const offsetValue = offset !== undefined ? Math.max(0, parseInt(offset)) : (pageValue && perPage ? (pageValue - 1) * Math.max(1, parseInt(perPage)) : 0)

package/src/fetchers/static-collection.ts

@@ -1,4 +1,8 @@
-import { generateDateFormatterCode } from '../utils'
+import {
+  generateDateFormatterCode,
+  generateSortFilterHelperCode,
+  generateSafeJSONParseCode,
+} from '../utils'
 
 export const validateStaticCollectionConfig = (
   config: Record<string, unknown>
@@ -22,11 +26,15 @@ export const generateStaticCollectionFetcher = (config: Record<string, unknown>)
   const staticConfig = config as StaticCollectionConfig
   return `const data = ${JSON.stringify(staticConfig.data || [])}
 
+${generateSafeJSONParseCode()}
+
 ${generateDateFormatterCode()}
 
+${generateSortFilterHelperCode()}
+
 export default async function handler(req, res) {
   try {
-    const { query, queryColumns, limit, page, perPage, sortBy, sortOrder, filters, offset: offsetParam } = req.query
+    const { query, queryColumns, limit, page, perPage, sortBy, sortOrder, filters, sorts, offset: offsetParam } = req.query
     
     let filteredData = [...data]
     
@@ -34,10 +42,10 @@ export default async function handler(req, res) {
       const searchQuery = query.toLowerCase()
       
       if (queryColumns) {
-        const columns = JSON.parse(queryColumns)
+        const columns = safeJSONParse(queryColumns)
         filteredData = filteredData.filter((item) => {
           return columns.some((col) => {
-            const value = item[col]
+            const value = getNestedValue(item, col)
             return value && String(value).toLowerCase().includes(searchQuery)
           })
         })
@@ -54,25 +62,95 @@ export default async function handler(req, res) {
     }
     
     if (filters) {
-      const parsedFilters = JSON.parse(filters)
-      filteredData = filteredData.filter((item) => {
-        return Object.entries(parsedFilters).every(([key, value]) => {
-          if (Array.isArray(value)) {
-            return value.includes(item[key])
-          }
-          return item[key] === value
+      const parsedFilters = safeJSONParse(filters)
+      
+      if (Array.isArray(parsedFilters)) {
+        filteredData = filteredData.filter((item) => {
+          return parsedFilters.every((filter) => {
+            if (!filter.source || filter.destination === undefined) return true
+            
+            const field = filter.source
+            const value = getNestedValue(item, field)
+            const target = filter.destination
+            const operand = filter.operand || '='
+            
+            if (Array.isArray(target)) {
+              if (operand === '!=') {
+                return !target.includes(value)
+              }
+              return target.includes(value)
+            }
+            
+            return compareValues(value, target, operand)
+          })
         })
-      })
+      } else {
+        filteredData = filteredData.filter((item) => {
+          return Object.entries(parsedFilters).every(([key, value]) => {
+            const itemValue = getNestedValue(item, key)
+            if (Array.isArray(value)) {
+              return value.includes(itemValue)
+            }
+            return compareValues(itemValue, value, '=')
+          })
+        })
+      }
     }
     
-    if (sortBy) {
+    if (sorts) {
+      const parsedSorts = safeJSONParse(sorts)
+      if (Array.isArray(parsedSorts) && parsedSorts.length > 0) {
+        filteredData.sort((a, b) => {
+          for (const sort of parsedSorts) {
+            if (!sort.field) continue
+            const aVal = getNestedValue(a, sort.field)
+            const bVal = getNestedValue(b, sort.field)
+            const sortOrderValue = sort.order?.toLowerCase() === 'desc' ? -1 : 1
+            
+            let comparison = 0
+            if (aVal === null || aVal === undefined) {
+              comparison = bVal === null || bVal === undefined ? 0 : -1
+            } else if (bVal === null || bVal === undefined) {
+              comparison = 1
+            } else if (typeof aVal === 'number' && typeof bVal === 'number') {
+              comparison = aVal - bVal
+            } else if (aVal instanceof Date && bVal instanceof Date) {
+              comparison = aVal.getTime() - bVal.getTime()
+            } else {
+              const aStr = String(aVal)
+              const bStr = String(bVal)
+              if (aStr < bStr) comparison = -1
+              else if (aStr > bStr) comparison = 1
+            }
+            
+            if (comparison !== 0) return comparison * sortOrderValue
+          }
+          return 0
+        })
+      }
+    } else if (sortBy) {
       filteredData.sort((a, b) => {
-        const aVal = a[sortBy]
-        const bVal = b[sortBy]
+        const aVal = getNestedValue(a, sortBy)
+        const bVal = getNestedValue(b, sortBy)
         const sortOrderValue = sortOrder?.toLowerCase() === 'desc' ? -1 : 1
-        if (aVal < bVal) return -sortOrderValue
-        if (aVal > bVal) return sortOrderValue
-        return 0
+        
+        let comparison = 0
+        if (aVal === null || aVal === undefined) {
+          comparison = bVal === null || bVal === undefined ? 0 : -1
+        } else if (bVal === null || bVal === undefined) {
+          comparison = 1
+        } else if (typeof aVal === 'number' && typeof bVal === 'number') {
+          comparison = aVal - bVal
+        } else if (aVal instanceof Date && bVal instanceof Date) {
+          comparison = aVal.getTime() - bVal.getTime()
+        } else {
+          const aStr = String(aVal)
+          const bStr = String(bVal)
+          if (aStr < bStr) comparison = -1
+          else if (aStr > bStr) comparison = 1
+        }
+        
+        return comparison * sortOrderValue
       })
     }