@warlock.js/cascade 5.19.1 → 5.21.0

package/esm/drivers/postgres/postgres-query-parser.mjs

@@ -1,6 +1,10 @@
-import { PostgresDialect } from "./postgres-dialect.mjs";
+import { PostgresDialect, escapeSqlLiteral } from "./postgres-dialect.mjs";
 
 //#region ../cascade/src/drivers/postgres/postgres-query-parser.ts
+/** Allowed `::cast` type names, e.g. `int`, `numeric(10,2)`, `text[]`. */
+const SAFE_CAST_PATTERN = /^[a-z_][a-z0-9_ ]*(\(\d+(,\d+)?\))?(\[\])?$/i;
+/** Allowed orderBy direction, with optional NULLS placement. */
+const SAFE_DIRECTION_PATTERN = /^(asc|desc)(\s+nulls\s+(first|last))?$/i;
 /**
 * PostgreSQL Query Parser.
 *
@@ -188,12 +192,27 @@ var PostgresQueryParser = class PostgresQueryParser {
 			case "whereNotIn":
 				this.processWhereIn(data, true);
 				break;
+			case "orWhereIn":
+				this.processWhereIn(data, false, "OR");
+				break;
+			case "orWhereNotIn":
+				this.processWhereIn(data, true, "OR");
+				break;
 			case "whereNull":
 				this.processWhereNull(data, false);
 				break;
 			case "whereNotNull":
 				this.processWhereNull(data, true);
 				break;
+			case "orWhereNull":
+				this.processWhereNull(data, false, "OR");
+				break;
+			case "orWhereNotNull":
+				this.processWhereNull(data, true, "OR");
+				break;
+			case "orWhereBetween":
+				this.processWhereBetween(data, false, "OR");
+				break;
 			case "whereBetween":
 				this.processWhereBetween(data, false);
 				break;
@@ -221,6 +240,30 @@ var PostgresQueryParser = class PostgresQueryParser {
 			case "whereFullText":
 				this.processWhereFullText(data);
 				break;
+			case "whereNot":
+				this.processNested(data.nested, "AND", true, type);
+				break;
+			case "orWhereNot":
+				this.processNested(data.nested, "OR", true, type);
+				break;
+			case "whereExists":
+				this.processNested(data.subquery, "AND", false, type);
+				break;
+			case "whereNotExists":
+				this.processNested(data.subquery, "AND", true, type);
+				break;
+			case "whereDate":
+				this.processWhereDate(data, "=");
+				break;
+			case "whereDateBefore":
+				this.processWhereDate(data, "<");
+				break;
+			case "whereDateAfter":
+				this.processWhereDate(data, ">");
+				break;
+			case "whereDateBetween":
+				this.processWhereDateBetween(data);
+				break;
 			case "select":
 				this.processSelect(data);
 				break;
@@ -286,7 +329,9 @@ var PostgresQueryParser = class PostgresQueryParser {
 			case "selectRelatedColumns":
 				this.processSelectRelatedColumns(data);
 				break;
-			default: break;
+			case "cursor":
+			case "joinWith": break;
+			default: throw new Error(`PostgresQueryParser: unsupported operation type "${type}"`);
 		}
 	}
 	/**
@@ -369,40 +414,40 @@ var PostgresQueryParser = class PostgresQueryParser {
 	* single placeholder (between, in, like-variants, exists, etc.).
 	*/
 	processWhere(data, boolean) {
+		if (data.nested !== void 0) return this.processNested(data.nested, boolean, false, "where");
 		const field = data.field;
 		const operator = data.operator ?? "=";
 		const value = data.value;
+		const range = value;
+		const like = {
+			field,
+			pattern: value
+		};
 		switch (operator) {
 			case "between": return this.processWhereBetween({
 				field,
-				range: value
-			}, false);
+				range
+			}, false, boolean);
 			case "notBetween": return this.processWhereBetween({
 				field,
-				range: value
-			}, true);
+				range
+			}, true, boolean);
 			case "in": return this.processWhereIn({
 				field,
 				values: value
-			}, false);
+			}, false, boolean);
 			case "notIn": return this.processWhereIn({
 				field,
 				values: value
-			}, true);
+			}, true, boolean);
 			case "like":
-			case "ilike":
+			case "ilike": return this.processWhereLike(like, false, boolean);
 			case "startsWith":
-			case "endsWith": return this.processWhereLike({
-				field,
-				pattern: value
-			}, false);
-			case "notLike":
-			case "notStartsWith":
-			case "notEndsWith": return this.processWhereLike({
-				field,
-				pattern: value
-			}, true);
-			case "exists": return this.addWhereClause(`EXISTS (${value})`, boolean);
+			case "endsWith": return this.processWhereLike(like, false, boolean, operator);
+			case "notLike": return this.processWhereLike(like, true, boolean);
+			case "notStartsWith": return this.processWhereLike(like, true, boolean, "startsWith");
+			case "notEndsWith": return this.processWhereLike(like, true, boolean, "endsWith");
+			case "exists": throw new Error("PostgresQueryParser: where(field, \"exists\", value) does not accept a raw SQL string; use a query builder or callback");
 		}
 		const quotedField = this.parseColumnIdentifier(field, this.table, this.alias);
 		if (value === null) {
@@ -413,6 +458,42 @@ var PostgresQueryParser = class PostgresQueryParser {
 		this.addWhereClause(`${quotedField} ${this.mapOperator(operator)} ${placeholder}`, boolean);
 	}
 	/**
+	* Process a nested group of operations as `(<group>)` / `NOT (<group>)`.
+	*
+	* The group is parsed by a sub-parser; its params are renumbered into this
+	* parser's namespace.
+	*/
+	processNested(nested, boolean, negate, opType) {
+		const subParser = new PostgresQueryParser({
+			table: this.table,
+			alias: this.alias,
+			dialect: this.dialect,
+			operations: nested ?? []
+		});
+		subParser.parse();
+		if (subParser.whereClauses.length === 0) throw new Error(`PostgresQueryParser: "${opType}" received an empty condition group`);
+		const group = `(${this.absorbSubParserParams(subParser)(subParser.whereClauses.join(" "))})`;
+		this.addWhereClause(negate ? `NOT ${group}` : group, boolean);
+	}
+	/**
+	* Compare the date portion of a column (time ignored).
+	*/
+	processWhereDate(data, operator) {
+		const quotedField = this.parseColumnIdentifier(data.field, this.table, this.alias);
+		const placeholder = this.addParam(data.value);
+		this.addWhereClause(`${quotedField}::date ${operator} ${placeholder}::date`, "AND");
+	}
+	/**
+	* Date portion of a column within an inclusive [from, to] range.
+	*/
+	processWhereDateBetween(data) {
+		const range = data.range;
+		const quotedField = this.parseColumnIdentifier(data.field, this.table, this.alias);
+		const from = this.addParam(range[0]);
+		const to = this.addParam(range[1]);
+		this.addWhereClause(`${quotedField}::date BETWEEN ${from}::date AND ${to}::date`, "AND");
+	}
+	/**
 	* Process a raw WHERE operation.
 	*/
 	processWhereRaw(data, boolean) {
@@ -425,53 +506,72 @@ var PostgresQueryParser = class PostgresQueryParser {
 	/**
 	* Process WHERE IN / NOT IN.
 	*/
-	processWhereIn(data, negate) {
+	processWhereIn(data, negate, boolean = "AND") {
 		const field = data.field;
 		const values = data.values;
 		const quotedField = this.parseColumnIdentifier(field, this.table, this.alias);
 		const operator = negate ? "!= ALL" : "= ANY";
 		const placeholder = this.addParam(values);
-		this.addWhereClause(`${quotedField} ${operator}(${placeholder})`, "AND");
+		this.addWhereClause(`${quotedField} ${operator}(${placeholder})`, boolean);
 	}
 	/**
 	* Process WHERE NULL / NOT NULL.
 	*/
-	processWhereNull(data, negate) {
+	processWhereNull(data, negate, boolean = "AND") {
 		const field = data.field;
 		const quotedField = this.parseColumnIdentifier(field, this.table, this.alias);
 		const clause = negate ? `${quotedField} IS NOT NULL` : `${quotedField} IS NULL`;
-		this.addWhereClause(clause, "AND");
+		this.addWhereClause(clause, boolean);
 	}
 	/**
 	* Process WHERE BETWEEN / NOT BETWEEN.
 	*/
-	processWhereBetween(data, negate) {
+	processWhereBetween(data, negate, boolean = "AND") {
 		const field = data.field;
 		const range = data.range;
 		const quotedField = this.parseColumnIdentifier(field, this.table, this.alias);
 		const placeholder1 = this.addParam(range[0]);
 		const placeholder2 = this.addParam(range[1]);
 		const keyword = negate ? "NOT BETWEEN" : "BETWEEN";
-		this.addWhereClause(`${quotedField} ${keyword} ${placeholder1} AND ${placeholder2}`, "AND");
+		this.addWhereClause(`${quotedField} ${keyword} ${placeholder1} AND ${placeholder2}`, boolean);
 	}
 	/**
 	* Process WHERE LIKE / NOT LIKE.
+	*
+	* Cross-driver semantics (matches MongoDB): `%` is the only wildcard, `_`
+	* and backslash are literal, and a pattern with no `%` matches as a
+	* substring. `startsWith` / `endsWith` anchor the escaped text explicitly.
+	* A `RegExp` has no SQL equivalent and is rejected.
 	*/
-	processWhereLike(data, negate) {
+	processWhereLike(data, negate, boolean = "AND", modeArg) {
 		const field = data.field;
-		const pattern = data.pattern;
+		const mode = modeArg ?? data.mode;
+		if (data.isRegExp === true || data.pattern instanceof RegExp) {
+			const source = data.pattern instanceof RegExp ? data.pattern.source : String(data.pattern);
+			const regexField = this.parseColumnIdentifier(field, this.table, this.alias);
+			const regexPlaceholder = this.addParam(source);
+			return this.addWhereClause(`${regexField} ${negate ? "!~*" : "~*"} ${regexPlaceholder}`, boolean);
+		}
+		const pattern = String(mode && data.value !== void 0 ? data.value : data.pattern);
 		const quotedField = this.parseColumnIdentifier(field, this.table, this.alias);
 		const { operator } = this.dialect.likePattern(pattern, true);
-		const placeholder = this.addParam(pattern);
+		let escaped = pattern.replace(/\\/g, "\\\\").replace(/_/g, "\\_");
+		if (mode) escaped = escaped.replace(/%/g, "\\%");
+		let finalPattern = escaped;
+		if (mode === "startsWith") finalPattern = `${escaped}%`;
+		else if (mode === "endsWith") finalPattern = `%${escaped}`;
+		else if (!escaped.includes("%")) finalPattern = `%${escaped}%`;
+		const placeholder = this.addParam(finalPattern);
 		const keyword = negate ? `NOT ${operator}` : operator;
-		this.addWhereClause(`${quotedField} ${keyword} ${placeholder}`, "AND");
+		const escapeClause = mode ? " ESCAPE '\\'" : "";
+		this.addWhereClause(`${quotedField} ${keyword} ${placeholder}${escapeClause}`, boolean);
 	}
 	/**
 	* Process WHERE column comparison.
 	*/
 	processWhereColumn(data, boolean) {
 		const first = data.first;
-		const operator = data.operator ?? "=";
+		const operator = this.mapOperator(data.operator ?? "=");
 		const second = data.second;
 		const quotedFirst = this.parseColumnIdentifier(first, this.table, this.alias);
 		const quotedSecond = this.parseColumnIdentifier(second, this.table, this.alias);
@@ -484,9 +584,13 @@ var PostgresQueryParser = class PostgresQueryParser {
 		const path = data.path;
 		const value = data.value;
 		const quotedPath = this.parseColumnIdentifier(path, this.table, this.alias);
-		const jsonValue = JSON.stringify(value);
 		const operator = negate ? "NOT @>" : "@>";
-		this.addWhereClause(`${quotedPath} ${operator} '${jsonValue}'::jsonb`, "AND");
+		const placeholder = this.addParam(JSON.stringify(value));
+		this.addWhereClause(`${quotedPath} ${operator} ${placeholder}::jsonb`, "AND");
+	}
+	/** Text search config name; anything but a plain identifier falls back to english. */
+	safeLanguage(language) {
+		return typeof language === "string" && /^[a-z_]+$/i.test(language) ? language : "english";
 	}
 	/**
 	* Process full-text search WHERE.
@@ -494,9 +598,14 @@ var PostgresQueryParser = class PostgresQueryParser {
 	processWhereFullText(data) {
 		const fields = data.fields;
 		const query = data.query;
-		const tsVectors = fields.map((f) => `to_tsvector('english', ${this.dialect.quoteIdentifier(f)})`).join(" || ");
+		const language = this.safeLanguage(data.language);
+		const weights = data.weights ?? {};
+		const tsVectors = fields.map((f) => {
+			const weight = /^[A-D]$/.test(weights[f] ?? "") ? weights[f] : "A";
+			return `setweight(to_tsvector('${language}', COALESCE(${this.dialect.quoteIdentifier(f)}, '')), '${weight}')`;
+		}).join(" || ");
 		const placeholder = this.addParam(query);
-		this.addWhereClause(`(${tsVectors}) @@ plainto_tsquery('english', ${placeholder})`, "AND");
+		this.addWhereClause(`(${tsVectors}) @@ plainto_tsquery('${language}', ${placeholder})`, "AND");
 	}
 	/**
 	* Process SELECT operation.
@@ -560,7 +669,7 @@ var PostgresQueryParser = class PostgresQueryParser {
 			const quotedLocalKey = this.dialect.quoteIdentifier(localKey);
 			const quotedMainTable = this.dialect.quoteIdentifier(this.table);
 			let innerSelect;
-			if (select && select.length > 0) innerSelect = `json_agg(json_build_object(${select.map((col) => `'${col}', a.${this.dialect.quoteIdentifier(col)}`).join(", ")}))`;
+			if (select && select.length > 0) innerSelect = `json_agg(json_build_object(${select.map((col) => `'${escapeSqlLiteral(col)}', a.${this.dialect.quoteIdentifier(col)}`).join(", ")}))`;
 			else innerSelect = `json_agg(row_to_json(a.*))`;
 			const fkCondition = `a.${quotedForeignKey} = ${quotedMainTable}.${quotedLocalKey}`;
 			let extraWhere = "";
@@ -576,7 +685,7 @@ var PostgresQueryParser = class PostgresQueryParser {
 				const renumber = this.absorbSubParserParams(subParser);
 				if (subParser.whereClauses.length > 0) extraWhere = ` AND ${renumber(subParser.whereClauses.join(" "))}`;
 				if (subParser.orderClauses.length > 0) orderBy = ` ORDER BY ${renumber(subParser.orderClauses.join(", "))}`;
-				if (subParser.limitValue !== void 0) limitClause = ` LIMIT ${subParser.limitValue}`;
+				if (subParser.limitValue !== void 0) limitClause = ` ${this.dialect.limitOffset(subParser.limitValue)}`;
 			}
 			orderBy || limitClause ? `${quotedRelatedTable}${fkCondition}${extraWhere}${orderBy}${limitClause}` : `${innerSelect.replace("json_agg(", "").replace(/\)$/, "")}${quotedRelatedTable}${fkCondition}${extraWhere}`;
 			const aggregated = orderBy || limitClause ? `(SELECT json_agg(row_to_json(sub.*)) FROM (SELECT * FROM ${quotedRelatedTable} a WHERE ${fkCondition}${extraWhere}${orderBy}${limitClause}) sub) AS ${quotedAlias}` : `(SELECT ${innerSelect} FROM ${quotedRelatedTable} a WHERE ${fkCondition}${extraWhere}) AS ${quotedAlias}`;
@@ -679,7 +788,11 @@ var PostgresQueryParser = class PostgresQueryParser {
 			if (this.isTableReference(first)) expression = this.buildJsonbPath(first, second, rest);
 			else expression = this.buildJsonbPath(effectiveTable, first, [second, ...rest]);
 		}
-		return cast ? `(${expression})::${cast}` : expression;
+		if (cast) {
+			if (!SAFE_CAST_PATTERN.test(cast)) throw new Error(`PostgresQueryParser: unsafe cast type "${cast}"`);
+			return `(${expression})::${cast}`;
+		}
+		return expression;
 	}
 	/**
 	* Check if a string is a table reference (main table or join table).
@@ -715,7 +828,7 @@ var PostgresQueryParser = class PostgresQueryParser {
 		let expression = `${quotedTable}.${quotedColumn}`;
 		for (let i = 0; i < path.length; i++) {
 			const operator = i === path.length - 1 ? "->>" : "->";
-			expression += `${operator}'${path[i]}'`;
+			expression += `${operator}'${escapeSqlLiteral(path[i])}'`;
 		}
 		return expression;
 	}
@@ -742,7 +855,9 @@ var PostgresQueryParser = class PostgresQueryParser {
 	*/
 	processOrderBy(data) {
 		const field = data.field;
-		const direction = (data.direction ?? "asc").toUpperCase();
+		const rawDirection = String(data.direction ?? "asc").trim();
+		if (!SAFE_DIRECTION_PATTERN.test(rawDirection)) throw new Error(`PostgresQueryParser: invalid orderBy direction "${rawDirection}"`);
+		const direction = rawDirection.replace(/\s+/g, " ").toUpperCase();
 		const quotedField = this.parseColumnIdentifier(field, this.table, this.alias);
 		this.orderClauses.push(`${quotedField} ${direction}`);
 	}
@@ -777,7 +892,7 @@ var PostgresQueryParser = class PostgresQueryParser {
 	*/
 	processHaving(data) {
 		const field = data.field;
-		const operator = data.operator ?? "=";
+		const operator = this.mapOperator(data.operator ?? "=");
 		const value = data.value;
 		const quotedField = this.dialect.quoteIdentifier(field);
 		const placeholder = this.addParam(value);
@@ -808,7 +923,7 @@ var PostgresQueryParser = class PostgresQueryParser {
 	* dedicated processors and should never reach this method.
 	*/
 	mapOperator(operator) {
-		return {
+		const mapped = {
 			"=": "=",
 			"!=": "!=",
 			"<>": "<>",
@@ -819,7 +934,9 @@ var PostgresQueryParser = class PostgresQueryParser {
 			like: "LIKE",
 			notlike: "NOT LIKE",
 			ilike: "ILIKE"
-		}[operator.toLowerCase()] ?? operator;
+		}[String(operator).toLowerCase()];
+		if (mapped === void 0) throw new Error(`PostgresQueryParser: unsupported operator "${operator}"`);
+		return mapped;
 	}
 };