befly 2.0.9 → 2.0.11

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "befly",
-    "version": "2.0.9",
+    "version": "2.0.11",
     "description": "Buma - 为 Bun 专属打造的 API 接口框架核心引擎",
     "type": "module",
     "private": false,
@@ -51,5 +51,5 @@
         "README.md",
         "vitest.config.js"
     ],
-    "gitHead": "8e34968490883f145666d4cbd4bad89569b3aed8"
+    "gitHead": "b4be4ddfba91544b051e0c0f379c14de46cbdac9"
 }

package/plugins/db.js

@@ -78,7 +78,7 @@ export default {
                         return createQueryBuilder();
                     }
 
-                    // 私有方法：通用数据处理函数 - 自动添加ID和时间戳
+                    // 私有方法：通用数据处理函数 - 自动添加ID、时间戳和状态
                     async #processDataForInsert(data) {
                         const now = Date.now();
 
@@ -87,6 +87,7 @@ export default {
                                 data.map(async (item) => ({
                                     ...item,
                                     id: await befly.redis.genTimeID(),
+                                    state: item.state !== undefined ? item.state : 0,
                                     created_at: now,
                                     updated_at: now
                                 }))
@@ -95,12 +96,26 @@ export default {
                             return {
                                 ...data,
                                 id: await befly.redis.genTimeID(),
+                                state: data.state !== undefined ? data.state : 0,
                                 created_at: now,
                                 updated_at: now
                             };
                         }
                     }
 
+                    // 私有方法：添加默认的state过滤条件
+                    #addDefaultStateFilter(where = {}) {
+                        // 检查是否已有state相关条件
+                        const hasStateCondition = Object.keys(where).some((key) => key === 'state' || key.startsWith('state$'));
+
+                        // 如果没有state条件，添加默认过滤
+                        if (!hasStateCondition) {
+                            return { ...where, state$ne: 2 };
+                        }
+
+                        return where;
+                    }
+
                     // 私有方法：执行 SQL（支持传入连接对象）
                     async #executeWithConn(sql, params = [], conn = null) {
                         if (!sql || typeof sql !== 'string') {
@@ -147,7 +162,9 @@ export default {
                         const { where = {}, fields = '*', leftJoins = [] } = typeof options === 'object' && !Array.isArray(options) ? options : { where: options };
 
                         try {
-                            const builder = createQueryBuilder().select(fields).from(table).where(where).limit(1);
+                            // 添加默认的state过滤条件
+                            const filteredWhere = this.#addDefaultStateFilter(where);
+                            const builder = createQueryBuilder().select(fields).from(table).where(filteredWhere).limit(1);
 
                             // 添加 LEFT JOIN
                             leftJoins.forEach((join) => {
@@ -179,7 +196,9 @@ export default {
                         const { where = {}, fields = '*', leftJoins = [], orderBy = [], groupBy = [], having = [], page = 1, pageSize = 10 } = options;
 
                         try {
-                            const builder = createQueryBuilder().select(fields).from(table).where(where);
+                            // 添加默认的state过滤条件
+                            const filteredWhere = this.#addDefaultStateFilter(where);
+                            const builder = createQueryBuilder().select(fields).from(table).where(filteredWhere);
 
                             // 添加 LEFT JOIN
                             leftJoins.forEach((join) => {
@@ -216,12 +235,12 @@ export default {
                             }
 
                             const { sql, params } = builder.toSelectSql();
-                            const list = await this.#executeWithConn(sql, params, conn);
+                            const rows = await this.#executeWithConn(sql, params, conn);
 
                             // 获取总数（如果需要分页）
                             let total = 0;
                             if (numPage > 0 && numPageSize > 0) {
-                                const countBuilder = createQueryBuilder().from(table).where(where);
+                                const countBuilder = createQueryBuilder().from(table).where(filteredWhere);
 
                                 // 计算总数时也要包含 JOIN
                                 leftJoins.forEach((join) => {
@@ -241,7 +260,7 @@ export default {
                             }
 
                             return {
-                                list: Array.isArray(list) ? list : [],
+                                rows: Array.isArray(rows) ? rows : [],
                                 total,
                                 page: numPage,
                                 pageSize: numPageSize
@@ -261,7 +280,9 @@ export default {
                         const { where = {}, fields = '*', leftJoins = [], orderBy = [] } = typeof options === 'object' && !Array.isArray(options) ? options : { where: options };
 
                         try {
-                            const builder = createQueryBuilder().select(fields).from(table).where(where);
+                            // 添加默认的state过滤条件
+                            const filteredWhere = this.#addDefaultStateFilter(where);
+                            const builder = createQueryBuilder().select(fields).from(table).where(filteredWhere);
 
                             // 添加 LEFT JOIN
                             leftJoins.forEach((join) => {
@@ -310,7 +331,7 @@ export default {
                     }
 
                     // 私有方法：更新数据（支持传入连接对象）
-                    async #upDataWithConn(table, data, where, conn = null) {
+                    async #updDataWithConn(table, data, where, conn = null) {
                         if (!table || typeof table !== 'string') {
                             throw new Error('表名是必需的');
                         }
@@ -337,7 +358,7 @@ export default {
                             const { sql, params } = builder.toUpdateSql(table, updateData);
                             return await this.#executeWithConn(sql, params, conn);
                         } catch (error) {
-                            Logger.error('upData 执行失败:', error);
+                            Logger.error('updData 执行失败:', error);
                             throw error;
                         }
                     }
@@ -362,6 +383,32 @@ export default {
                         }
                     }
 
+                    // 私有方法：软删除数据（支持传入连接对象）
+                    async #delData2WithConn(table, where, conn = null) {
+                        if (!table || typeof table !== 'string') {
+                            throw new Error('表名是必需的');
+                        }
+
+                        if (!where) {
+                            throw new Error('软删除操作需要 WHERE 条件');
+                        }
+
+                        try {
+                            // 软删除：将 state 设置为 2，同时更新 updated_at
+                            const updateData = {
+                                state: 2,
+                                updated_at: Date.now()
+                            };
+
+                            const builder = createQueryBuilder().where(where);
+                            const { sql, params } = builder.toUpdateSql(table, updateData);
+                            return await this.#executeWithConn(sql, params, conn);
+                        } catch (error) {
+                            Logger.error('delData2 执行失败:', error);
+                            throw error;
+                        }
+                    }
+
                     // 私有方法：批量插入（支持传入连接对象）
                     async #insBatchWithConn(table, dataArray, conn = null) {
                         if (!table || typeof table !== 'string') {
@@ -392,7 +439,9 @@ export default {
                         const { where = {}, leftJoins = [] } = typeof options === 'object' && !Array.isArray(options) ? options : { where: options };
 
                         try {
-                            const builder = createQueryBuilder().from(table).where(where);
+                            // 添加默认的state过滤条件
+                            const filteredWhere = this.#addDefaultStateFilter(where);
+                            const builder = createQueryBuilder().from(table).where(filteredWhere);
 
                             // 添加 LEFT JOIN
                             leftJoins.forEach((join) => {
@@ -441,8 +490,8 @@ export default {
                     }
 
                     // 更新数据 - 增强版，自动添加 updated_at，过滤敏感字段
-                    async upData(table, data, where) {
-                        return await this.#upDataWithConn(table, data, where);
+                    async updData(table, data, where) {
+                        return await this.#updDataWithConn(table, data, where);
                     }
 
                     // 删除数据
@@ -450,6 +499,11 @@ export default {
                         return await this.#delDataWithConn(table, where);
                     }
 
+                    // 软删除数据 - 将 state 设置为 2
+                    async delData2(table, where) {
+                        return await this.#delData2WithConn(table, where);
+                    }
+
                     // 批量插入 - 增强版，自动添加 ID 和时间戳
                     async insBatch(table, dataArray) {
                         return await this.#insBatchWithConn(table, dataArray);
@@ -498,14 +552,18 @@ export default {
                                     return await this.#insDataWithConn(table, data, conn);
                                 },
 
-                                upData: async (table, data, where) => {
-                                    return await this.#upDataWithConn(table, data, where, conn);
+                                updData: async (table, data, where) => {
+                                    return await this.#updDataWithConn(table, data, where, conn);
                                 },
 
                                 delData: async (table, where) => {
                                     return await this.#delDataWithConn(table, where, conn);
                                 },
 
+                                delData2: async (table, where) => {
+                                    return await this.#delData2WithConn(table, where, conn);
+                                },
+
                                 getCount: async (table, options = {}) => {
                                     return await this.#getCountWithConn(table, options, conn);
                                 },

package/utils/curd.js

@@ -20,11 +20,82 @@ export class SqlBuilder {
         return this;
     }
 
+    // 字段转义方法 - 处理字段名和表名的着重号转义
+    _escapeField(field) {
+        if (typeof field !== 'string') {
+            return field;
+        }
+
+        // 去除前后空格
+        field = field.trim();
+
+        // 如果是 * 或已经有着重号，直接返回
+        if (field === '*' || field.startsWith('`') || field.includes('(')) {
+            return field;
+        }
+
+        // 处理别名（AS关键字）
+        if (field.toUpperCase().includes(' AS ')) {
+            const parts = field.split(/\s+AS\s+/i);
+            const fieldPart = parts[0].trim();
+            const aliasPart = parts[1].trim();
+            return `${this._escapeField(fieldPart)} AS ${aliasPart}`;
+        }
+
+        // 处理表名.字段名的情况（多表联查）
+        if (field.includes('.')) {
+            const parts = field.split('.');
+            return parts
+                .map((part) => {
+                    part = part.trim();
+                    // 如果是 * 或已经有着重号，不再处理
+                    if (part === '*' || part.startsWith('`')) {
+                        return part;
+                    }
+                    return `\`${part}\``;
+                })
+                .join('.');
+        }
+
+        // 处理单个字段名
+        return `\`${field}\``;
+    }
+
+    // 转义表名
+    _escapeTable(table) {
+        if (typeof table !== 'string') {
+            return table;
+        }
+
+        table = table.trim();
+
+        // 如果已经有着重号，直接返回
+        if (table.startsWith('`')) {
+            return table;
+        }
+
+        // 处理表别名（表名 + 空格 + 别名）
+        if (table.includes(' ')) {
+            const parts = table.split(/\s+/);
+            if (parts.length === 2) {
+                // 只有表名和别名的情况
+                const tableName = parts[0].trim();
+                const alias = parts[1].trim();
+                return `\`${tableName}\` ${alias}`;
+            } else {
+                // 复杂情况，直接返回
+                return table;
+            }
+        }
+
+        return `\`${table}\``;
+    }
+
     select(fields = '*') {
         if (Array.isArray(fields)) {
-            this._select = [...this._select, ...fields];
+            this._select = [...this._select, ...fields.map((field) => this._escapeField(field))];
         } else if (typeof fields === 'string') {
-            this._select.push(fields);
+            this._select.push(this._escapeField(fields));
         } else {
             throw new Error('SELECT fields must be string or array');
         }
@@ -35,7 +106,7 @@ export class SqlBuilder {
         if (typeof table !== 'string' || !table.trim()) {
             throw new Error('FROM table must be a non-empty string');
         }
-        this._from = table.trim();
+        this._from = this._escapeTable(table.trim());
         return this;
     }
 
@@ -86,6 +157,7 @@ export class SqlBuilder {
                 // 一级属性格式：age$gt, role$in 等
                 const lastDollarIndex = key.lastIndexOf('$');
                 const fieldName = key.substring(0, lastDollarIndex);
+                const escapedFieldName = this._escapeField(fieldName);
                 const operator = '$' + key.substring(lastDollarIndex + 1);
 
                 this._validateParam(value);
@@ -93,13 +165,13 @@ export class SqlBuilder {
                 switch (operator) {
                     case '$ne':
                     case '$not':
-                        this._where.push(`${fieldName} != ?`);
+                        this._where.push(`${escapedFieldName} != ?`);
                         this._params.push(value);
                         break;
                     case '$in':
                         if (Array.isArray(value) && value.length > 0) {
                             const placeholders = value.map(() => '?').join(',');
-                            this._where.push(`${fieldName} IN (${placeholders})`);
+                            this._where.push(`${escapedFieldName} IN (${placeholders})`);
                             this._params.push(...value);
                         }
                         break;
@@ -107,64 +179,65 @@ export class SqlBuilder {
                     case '$notIn':
                         if (Array.isArray(value) && value.length > 0) {
                             const placeholders = value.map(() => '?').join(',');
-                            this._where.push(`${fieldName} NOT IN (${placeholders})`);
+                            this._where.push(`${escapedFieldName} NOT IN (${placeholders})`);
                             this._params.push(...value);
                         }
                         break;
                     case '$like':
-                        this._where.push(`${fieldName} LIKE ?`);
+                        this._where.push(`${escapedFieldName} LIKE ?`);
                         this._params.push(value);
                         break;
                     case '$notLike':
-                        this._where.push(`${fieldName} NOT LIKE ?`);
+                        this._where.push(`${escapedFieldName} NOT LIKE ?`);
                         this._params.push(value);
                         break;
                     case '$gt':
-                        this._where.push(`${fieldName} > ?`);
+                        this._where.push(`${escapedFieldName} > ?`);
                         this._params.push(value);
                         break;
                     case '$gte':
-                        this._where.push(`${fieldName} >= ?`);
+                        this._where.push(`${escapedFieldName} >= ?`);
                         this._params.push(value);
                         break;
                     case '$lt':
-                        this._where.push(`${fieldName} < ?`);
+                        this._where.push(`${escapedFieldName} < ?`);
                         this._params.push(value);
                         break;
                     case '$lte':
-                        this._where.push(`${fieldName} <= ?`);
+                        this._where.push(`${escapedFieldName} <= ?`);
                         this._params.push(value);
                         break;
                     case '$between':
                         if (Array.isArray(value) && value.length === 2) {
-                            this._where.push(`${fieldName} BETWEEN ? AND ?`);
+                            this._where.push(`${escapedFieldName} BETWEEN ? AND ?`);
                             this._params.push(value[0], value[1]);
                         }
                         break;
                     case '$notBetween':
                         if (Array.isArray(value) && value.length === 2) {
-                            this._where.push(`${fieldName} NOT BETWEEN ? AND ?`);
+                            this._where.push(`${escapedFieldName} NOT BETWEEN ? AND ?`);
                             this._params.push(value[0], value[1]);
                         }
                         break;
                     case '$null':
                         if (value === true) {
-                            this._where.push(`${fieldName} IS NULL`);
+                            this._where.push(`${escapedFieldName} IS NULL`);
                         }
                         break;
                     case '$notNull':
                         if (value === true) {
-                            this._where.push(`${fieldName} IS NOT NULL`);
+                            this._where.push(`${escapedFieldName} IS NOT NULL`);
                         }
                         break;
                     default:
-                        this._where.push(`${fieldName} = ?`);
+                        this._where.push(`${escapedFieldName} = ?`);
                         this._params.push(value);
                 }
             } else {
                 // 简单的等于条件
                 this._validateParam(value);
-                this._where.push(`${key} = ?`);
+                const escapedKey = this._escapeField(key);
+                this._where.push(`${escapedKey} = ?`);
                 this._params.push(value);
             }
         });
@@ -176,7 +249,8 @@ export class SqlBuilder {
             this._processWhereConditions(condition);
         } else if (value !== null) {
             this._validateParam(value);
-            this._where.push(`${condition} = ?`);
+            const escapedCondition = this._escapeField(condition);
+            this._where.push(`${escapedCondition} = ?`);
             this._params.push(value);
         } else if (typeof condition === 'string') {
             this._where.push(condition);
@@ -188,55 +262,46 @@ export class SqlBuilder {
         if (typeof table !== 'string' || typeof on !== 'string') {
             throw new Error('JOIN table and condition must be strings');
         }
-        this._joins.push(`LEFT JOIN ${table} ON ${on}`);
+        const escapedTable = this._escapeTable(table);
+        this._joins.push(`LEFT JOIN ${escapedTable} ON ${on}`);
         return this;
     }
 
-    orderBy(field, direction = 'ASC') {
-        if (Array.isArray(field)) {
-            field.forEach((item) => {
-                if (typeof item === 'string' && item.includes('#')) {
-                    const [fieldName, dir] = item.split('#');
-                    const cleanDir = (dir || 'ASC').trim().toUpperCase();
-                    if (!['ASC', 'DESC'].includes(cleanDir)) {
-                        throw new Error('ORDER BY direction must be ASC or DESC');
-                    }
-                    this._orderBy.push(`${fieldName.trim()} ${cleanDir}`);
-                } else if (Array.isArray(item) && item.length >= 1) {
-                    const [fieldName, dir] = item;
-                    const cleanDir = (dir || 'ASC').toUpperCase();
-                    if (!['ASC', 'DESC'].includes(cleanDir)) {
-                        throw new Error('ORDER BY direction must be ASC or DESC');
-                    }
-                    this._orderBy.push(`${fieldName} ${cleanDir}`);
-                } else if (typeof item === 'string') {
-                    this._orderBy.push(`${item} ASC`);
-                }
-            });
-        } else if (typeof field === 'string') {
-            if (field.includes('#')) {
-                const [fieldName, dir] = field.split('#');
-                const cleanDir = (dir || 'ASC').trim().toUpperCase();
-                if (!['ASC', 'DESC'].includes(cleanDir)) {
-                    throw new Error('ORDER BY direction must be ASC or DESC');
-                }
-                this._orderBy.push(`${fieldName.trim()} ${cleanDir}`);
-            } else {
-                const cleanDir = direction.toUpperCase();
-                if (!['ASC', 'DESC'].includes(cleanDir)) {
-                    throw new Error('ORDER BY direction must be ASC or DESC');
-                }
-                this._orderBy.push(`${field} ${cleanDir}`);
-            }
+    orderBy(fields) {
+        if (!Array.isArray(fields)) {
+            throw new Error('orderBy must be an array of strings in "field#direction" format');
         }
+
+        fields.forEach((item) => {
+            if (typeof item !== 'string' || !item.includes('#')) {
+                throw new Error('orderBy field must be a string in "field#direction" format (e.g., "name#ASC", "id#DESC")');
+            }
+
+            const [fieldName, direction] = item.split('#');
+            const cleanField = fieldName.trim();
+            const cleanDir = direction.trim().toUpperCase();
+
+            if (!cleanField) {
+                throw new Error('Field name cannot be empty in orderBy');
+            }
+
+            if (!['ASC', 'DESC'].includes(cleanDir)) {
+                throw new Error('ORDER BY direction must be ASC or DESC');
+            }
+
+            const escapedField = this._escapeField(cleanField);
+            this._orderBy.push(`${escapedField} ${cleanDir}`);
+        });
+
         return this;
     }
 
     groupBy(field) {
         if (Array.isArray(field)) {
-            this._groupBy = [...this._groupBy, ...field.filter((f) => typeof f === 'string')];
+            const escapedFields = field.filter((f) => typeof f === 'string').map((f) => this._escapeField(f));
+            this._groupBy = [...this._groupBy, ...escapedFields];
         } else if (typeof field === 'string') {
-            this._groupBy.push(field);
+            this._groupBy.push(this._escapeField(field));
         }
         return this;
     }
@@ -321,6 +386,8 @@ export class SqlBuilder {
             throw new Error('Data is required for INSERT');
         }
 
+        const escapedTable = this._escapeTable(table);
+
         if (Array.isArray(data)) {
             if (data.length === 0) {
                 throw new Error('Insert data cannot be empty');
@@ -331,10 +398,11 @@ export class SqlBuilder {
                 throw new Error('Insert data must have at least one field');
             }
 
+            const escapedFields = fields.map((field) => this._escapeField(field));
             const placeholders = fields.map(() => '?').join(', ');
             const values = data.map(() => `(${placeholders})`).join(', ');
 
-            const sql = `INSERT INTO ${table} (${fields.join(', ')}) VALUES ${values}`;
+            const sql = `INSERT INTO ${escapedTable} (${escapedFields.join(', ')}) VALUES ${values}`;
             const params = data.flatMap((row) => fields.map((field) => row[field]));
 
             return { sql, params };
@@ -344,8 +412,9 @@ export class SqlBuilder {
                 throw new Error('Insert data must have at least one field');
             }
 
+            const escapedFields = fields.map((field) => this._escapeField(field));
             const placeholders = fields.map(() => '?').join(', ');
-            const sql = `INSERT INTO ${table} (${fields.join(', ')}) VALUES (${placeholders})`;
+            const sql = `INSERT INTO ${escapedTable} (${escapedFields.join(', ')}) VALUES (${placeholders})`;
             const params = fields.map((field) => data[field]);
 
             return { sql, params };
@@ -367,10 +436,11 @@ export class SqlBuilder {
             throw new Error('Update data must have at least one field');
         }
 
-        const setFields = fields.map((field) => `${field} = ?`);
+        const escapedTable = this._escapeTable(table);
+        const setFields = fields.map((field) => `${this._escapeField(field)} = ?`);
         const params = [...Object.values(data), ...this._params];
 
-        let sql = `UPDATE ${table} SET ${setFields.join(', ')}`;
+        let sql = `UPDATE ${escapedTable} SET ${setFields.join(', ')}`;
 
         if (this._where.length > 0) {
             sql += ' WHERE ' + this._where.join(' AND ');
@@ -387,7 +457,8 @@ export class SqlBuilder {
             throw new Error('Table name is required for DELETE');
         }
 
-        let sql = `DELETE FROM ${table}`;
+        const escapedTable = this._escapeTable(table);
+        let sql = `DELETE FROM ${escapedTable}`;
 
         if (this._where.length > 0) {
             sql += ' WHERE ' + this._where.join(' AND ');