befly 3.9.40 → 3.10.1

package/tests/dbHelper-joins.test.ts

@@ -1,238 +1,147 @@
 /**
  * DbHelper JOIN 功能测试
- * 测试多表联查相关功能（不支持表别名）
+ * 测试多表联查相关功能（推荐使用表别名）
  */
 
 import { describe, test, expect } from "bun:test";
 
-import { snakeCase } from "es-toolkit/string";
+import { DbUtils } from "../lib/dbUtils.js";
 
-// ============================================
-// 辅助函数单元测试（模拟 DbHelper 私有方法）
-// ============================================
-
-/**
- * 处理表名（转下划线格式）
- */
-function processTableName(table: string): string {
-    return snakeCase(table.trim());
-}
-
-/**
- * 处理联查字段（支持表名.字段名格式）
- */
-function processJoinField(field: string): string {
-    if (field.includes("(") || field === "*" || field.startsWith("`")) {
-        return field;
-    }
-
-    if (field.toUpperCase().includes(" AS ")) {
-        const [fieldPart, aliasPart] = field.split(/\s+AS\s+/i);
-        return `${processJoinField(fieldPart.trim())} AS ${aliasPart.trim()}`;
-    }
-
-    if (field.includes(".")) {
-        const [tableName, fieldName] = field.split(".");
-        return `${snakeCase(tableName)}.${snakeCase(fieldName)}`;
-    }
-
-    return snakeCase(field);
-}
-
-/**
- * 处理联查 where 条件键名
- */
-function processJoinWhereKey(key: string): string {
-    if (key === "$or" || key === "$and") {
-        return key;
-    }
-
-    if (key.includes("$")) {
-        const lastDollarIndex = key.lastIndexOf("$");
-        const fieldPart = key.substring(0, lastDollarIndex);
-        const operator = key.substring(lastDollarIndex);
-
-        if (fieldPart.includes(".")) {
-            const [tableName, fieldName] = fieldPart.split(".");
-            return `${snakeCase(tableName)}.${snakeCase(fieldName)}${operator}`;
-        }
-        return `${snakeCase(fieldPart)}${operator}`;
-    }
-
-    if (key.includes(".")) {
-        const [tableName, fieldName] = key.split(".");
-        return `${snakeCase(tableName)}.${snakeCase(fieldName)}`;
-    }
-
-    return snakeCase(key);
-}
-
-/**
- * 递归处理联查 where 条件
- */
-function processJoinWhere(where: any): any {
-    if (!where || typeof where !== "object") return where;
-
-    if (Array.isArray(where)) {
-        return where.map((item) => processJoinWhere(item));
-    }
-
-    const result: any = {};
-    for (const [key, value] of Object.entries(where)) {
-        const newKey = processJoinWhereKey(key);
-
-        if (key === "$or" || key === "$and") {
-            result[newKey] = (value as any[]).map((item) => processJoinWhere(item));
-        } else if (typeof value === "object" && value !== null && !Array.isArray(value)) {
-            result[newKey] = processJoinWhere(value);
-        } else {
-            result[newKey] = value;
-        }
-    }
-    return result;
-}
+describe("DbUtils tableRef - normalizeTableRef/getJoinMainQualifier", () => {
+    test("普通表名转下划线（无 alias）", () => {
+        expect(DbUtils.normalizeTableRef("userProfile")).toBe("user_profile");
+        expect(DbUtils.normalizeTableRef("orderDetail")).toBe("order_detail");
+        expect(DbUtils.normalizeTableRef("user")).toBe("user");
+        expect(DbUtils.normalizeTableRef("order")).toBe("order");
+    });
 
-/**
- * 处理联查 orderBy
- */
-function processJoinOrderBy(orderBy: string[]): string[] {
-    if (!orderBy || !Array.isArray(orderBy)) return orderBy;
-    return orderBy.map((item) => {
-        if (typeof item !== "string" || !item.includes("#")) return item;
-        const [field, direction] = item.split("#");
-        return `${processJoinField(field.trim())}#${direction.trim()}`;
+    test("带 alias 的 tableRef：只转换 schema/table，不改 alias", () => {
+        expect(DbUtils.normalizeTableRef("UserProfile up")).toBe("user_profile up");
+        expect(DbUtils.normalizeTableRef("myDb.UserProfile up")).toBe("my_db.user_profile up");
     });
-}
-
-// ============================================
-// 测试用例
-// ============================================
-
-describe("DbHelper JOIN - processTableName", () => {
-    test("普通表名转下划线", () => {
-        expect(processTableName("userProfile")).toBe("user_profile");
-        expect(processTableName("orderDetail")).toBe("order_detail");
-        expect(processTableName("user")).toBe("user");
-        expect(processTableName("order")).toBe("order");
+
+    test("JOIN 主限定符：优先 alias", () => {
+        expect(DbUtils.getJoinMainQualifier("order o")).toBe("o");
+        expect(DbUtils.getJoinMainQualifier("userProfile")).toBe("user_profile");
     });
 });
 
 describe("DbHelper JOIN - processJoinField", () => {
     test("带表名的字段", () => {
-        expect(processJoinField("order.userId")).toBe("order.user_id");
-        expect(processJoinField("user.userName")).toBe("user.user_name");
-        expect(processJoinField("order.createdAt")).toBe("order.created_at");
+        expect(DbUtils.processJoinField("o.userId")).toBe("o.user_id");
+        expect(DbUtils.processJoinField("u.userName")).toBe("u.user_name");
+        expect(DbUtils.processJoinField("o.createdAt")).toBe("o.created_at");
     });
 
-    test("表名也转下划线", () => {
-        expect(processJoinField("orderDetail.productId")).toBe("order_detail.product_id");
-        expect(processJoinField("userProfile.avatarUrl")).toBe("user_profile.avatar_url");
+    test("表/别名部分保持原样（JOIN 场景点号前通常是别名）", () => {
+        expect(DbUtils.processJoinField("orderDetail.productId")).toBe("orderDetail.product_id");
+        expect(DbUtils.processJoinField("userProfile.avatarUrl")).toBe("userProfile.avatar_url");
     });
 
     test("普通字段（无表名）", () => {
-        expect(processJoinField("userName")).toBe("user_name");
-        expect(processJoinField("createdAt")).toBe("created_at");
+        expect(DbUtils.processJoinField("userName")).toBe("user_name");
+        expect(DbUtils.processJoinField("createdAt")).toBe("created_at");
     });
 
     test("带 AS 别名的字段", () => {
-        expect(processJoinField("order.totalAmount AS total")).toBe("order.total_amount AS total");
-        expect(processJoinField("user.userName AS name")).toBe("user.user_name AS name");
-        expect(processJoinField("product.name AS productName")).toBe("product.name AS productName");
+        expect(DbUtils.processJoinField("o.totalAmount AS total")).toBe("o.total_amount AS total");
+        expect(DbUtils.processJoinField("u.userName AS name")).toBe("u.user_name AS name");
+        expect(DbUtils.processJoinField("p.name AS productName")).toBe("p.name AS productName");
     });
 
     test("函数字段保持原样", () => {
-        expect(processJoinField("COUNT(*)")).toBe("COUNT(*)");
-        expect(processJoinField("SUM(order.amount)")).toBe("SUM(order.amount)");
+        expect(DbUtils.processJoinField("COUNT(*)")).toBe("COUNT(*)");
+        expect(DbUtils.processJoinField("SUM(o.amount)")).toBe("SUM(o.amount)");
     });
 
     test("星号保持原样", () => {
-        expect(processJoinField("*")).toBe("*");
+        expect(DbUtils.processJoinField("*")).toBe("*");
     });
 
     test("已转义字段保持原样", () => {
-        expect(processJoinField("`order`")).toBe("`order`");
+        expect(DbUtils.processJoinField("`order`")).toBe("`order`");
     });
 });
 
 describe("DbHelper JOIN - processJoinWhereKey", () => {
     test("带表名的字段名", () => {
-        expect(processJoinWhereKey("order.userId")).toBe("order.user_id");
-        expect(processJoinWhereKey("user.userName")).toBe("user.user_name");
+        expect(DbUtils.processJoinWhereKey("o.userId")).toBe("o.user_id");
+        expect(DbUtils.processJoinWhereKey("u.userName")).toBe("u.user_name");
     });
 
     test("带表名和操作符的字段名", () => {
-        expect(processJoinWhereKey("order.createdAt$gt")).toBe("order.created_at$gt");
-        expect(processJoinWhereKey("user.status$in")).toBe("user.status$in");
-        expect(processJoinWhereKey("order.amount$gte")).toBe("order.amount$gte");
+        expect(DbUtils.processJoinWhereKey("o.createdAt$gt")).toBe("o.created_at$gt");
+        expect(DbUtils.processJoinWhereKey("u.status$in")).toBe("u.status$in");
+        expect(DbUtils.processJoinWhereKey("o.amount$gte")).toBe("o.amount$gte");
     });
 
     test("普通字段带操作符", () => {
-        expect(processJoinWhereKey("createdAt$gt")).toBe("created_at$gt");
-        expect(processJoinWhereKey("userId$ne")).toBe("user_id$ne");
+        expect(DbUtils.processJoinWhereKey("createdAt$gt")).toBe("created_at$gt");
+        expect(DbUtils.processJoinWhereKey("userId$ne")).toBe("user_id$ne");
     });
 
     test("逻辑操作符保持原样", () => {
-        expect(processJoinWhereKey("$or")).toBe("$or");
-        expect(processJoinWhereKey("$and")).toBe("$and");
+        expect(DbUtils.processJoinWhereKey("$or")).toBe("$or");
+        expect(DbUtils.processJoinWhereKey("$and")).toBe("$and");
     });
 });
 
 describe("DbHelper JOIN - processJoinWhere", () => {
     test("简单条件", () => {
-        const where = { "order.userId": 1, "order.state": 1 };
-        const result = processJoinWhere(where);
-        expect(result).toEqual({ "order.user_id": 1, "order.state": 1 });
+        const where = { "o.userId": 1, "o.state": 1 };
+        const result = DbUtils.processJoinWhere(where);
+        expect(result).toEqual({ "o.user_id": 1, "o.state": 1 });
     });
 
     test("带操作符的条件", () => {
-        const where = { "order.createdAt$gt": 1000, "user.state$ne": 0 };
-        const result = processJoinWhere(where);
-        expect(result).toEqual({ "order.created_at$gt": 1000, "user.state$ne": 0 });
+        const where = { "o.createdAt$gt": 1000, "u.state$ne": 0 };
+        const result = DbUtils.processJoinWhere(where);
+        expect(result).toEqual({ "o.created_at$gt": 1000, "u.state$ne": 0 });
     });
 
     test("$or 条件", () => {
         const where = {
-            $or: [{ "user.userName$like": "%test%" }, { "user.email$like": "%test%" }]
+            $or: [{ "u.userName$like": "%test%" }, { "u.email$like": "%test%" }]
         };
-        const result = processJoinWhere(where);
+        const result = DbUtils.processJoinWhere(where);
         expect(result).toEqual({
-            $or: [{ "user.user_name$like": "%test%" }, { "user.email$like": "%test%" }]
+            $or: [{ "u.user_name$like": "%test%" }, { "u.email$like": "%test%" }]
         });
     });
 
     test("复杂嵌套条件", () => {
         const where = {
-            "order.state": 1,
-            "user.state": 1,
-            $or: [{ "user.userName$like": "%test%" }, { "product.name$like": "%test%" }],
-            "order.createdAt$gte": 1000
+            "o.state": 1,
+            "u.state": 1,
+            $or: [{ "u.userName$like": "%test%" }, { "p.name$like": "%test%" }],
+            "o.createdAt$gte": 1000
         };
-        const result = processJoinWhere(where);
+        const result = DbUtils.processJoinWhere(where);
         expect(result).toEqual({
-            "order.state": 1,
-            "user.state": 1,
-            $or: [{ "user.user_name$like": "%test%" }, { "product.name$like": "%test%" }],
-            "order.created_at$gte": 1000
+            "o.state": 1,
+            "u.state": 1,
+            $or: [{ "u.user_name$like": "%test%" }, { "p.name$like": "%test%" }],
+            "o.created_at$gte": 1000
         });
     });
 });
 
 describe("DbHelper JOIN - processJoinOrderBy", () => {
     test("带表名的排序", () => {
-        const orderBy = ["order.createdAt#DESC", "user.userName#ASC"];
-        const result = processJoinOrderBy(orderBy);
-        expect(result).toEqual(["order.created_at#DESC", "user.user_name#ASC"]);
+        const orderBy = ["o.createdAt#DESC", "u.userName#ASC"];
+        const result = DbUtils.processJoinOrderBy(orderBy);
+        expect(result).toEqual(["o.created_at#DESC", "u.user_name#ASC"]);
     });
 
     test("普通排序", () => {
         const orderBy = ["createdAt#DESC"];
-        const result = processJoinOrderBy(orderBy);
+        const result = DbUtils.processJoinOrderBy(orderBy);
         expect(result).toEqual(["created_at#DESC"]);
     });
 
     test("无排序方向的保持原样", () => {
         const orderBy = ["id"];
-        const result = processJoinOrderBy(orderBy);
+        const result = DbUtils.processJoinOrderBy(orderBy);
         expect(result).toEqual(["id"]);
     });
 });
@@ -264,49 +173,49 @@ describe("DbHelper JOIN - 完整场景模拟", () => {
     test("订单列表联查参数处理", () => {
         // 模拟输入
         const options = {
-            table: "order",
+            table: "order o",
             joins: [
-                { table: "user", on: "order.userId = user.id" },
-                { table: "product", on: "order.productId = product.id" }
+                { table: "user u", on: "o.user_id = u.id" },
+                { table: "product p", on: "o.product_id = p.id" }
             ],
-            fields: ["order.id", "order.totalAmount", "user.userName", "product.name AS productName"],
+            fields: ["o.id", "o.totalAmount", "u.userName", "p.name AS productName"],
             where: {
-                "order.state": 1,
-                "user.state": 1,
-                "order.createdAt$gte": 1701388800000
+                "o.state": 1,
+                "u.state": 1,
+                "o.createdAt$gte": 1701388800000
             },
-            orderBy: ["order.createdAt#DESC"]
+            orderBy: ["o.createdAt#DESC"]
         };
 
-        // 处理表名
-        const processedTable = processTableName(options.table);
-        expect(processedTable).toBe("order");
+        // 处理表名（tableRef 规范化）
+        const processedTable = DbUtils.normalizeTableRef(options.table);
+        expect(processedTable).toBe("order o");
 
         // 处理字段
-        const processedFields = options.fields.map((f) => processJoinField(f));
-        expect(processedFields).toEqual(["order.id", "order.total_amount", "user.user_name", "product.name AS productName"]);
+        const processedFields = options.fields.map((f) => DbUtils.processJoinField(f));
+        expect(processedFields).toEqual(["o.id", "o.total_amount", "u.user_name", "p.name AS productName"]);
 
         // 处理 where
-        const processedWhere = processJoinWhere(options.where);
+        const processedWhere = DbUtils.processJoinWhere(options.where);
         expect(processedWhere).toEqual({
-            "order.state": 1,
-            "user.state": 1,
-            "order.created_at$gte": 1701388800000
+            "o.state": 1,
+            "u.state": 1,
+            "o.created_at$gte": 1701388800000
         });
 
         // 处理 orderBy
-        const processedOrderBy = processJoinOrderBy(options.orderBy);
-        expect(processedOrderBy).toEqual(["order.created_at#DESC"]);
+        const processedOrderBy = DbUtils.processJoinOrderBy(options.orderBy);
+        expect(processedOrderBy).toEqual(["o.created_at#DESC"]);
 
         // 处理 joins
         const processedJoins = options.joins.map((j) => ({
             type: (j as any).type || "left",
-            table: processTableName(j.table),
+            table: DbUtils.normalizeTableRef(j.table),
             on: j.on
         }));
         expect(processedJoins).toEqual([
-            { type: "left", table: "user", on: "order.userId = user.id" },
-            { type: "left", table: "product", on: "order.productId = product.id" }
+            { type: "left", table: "user u", on: "o.user_id = u.id" },
+            { type: "left", table: "product p", on: "o.product_id = p.id" }
         ]);
     });
 });

package/tests/fixtures/scanFilesAddon/node_modules/@befly-addon/demo/apis/sub/b.ts

@@ -0,0 +1,3 @@
+export default {
+    name: "B"
+};

package/tests/fixtures/scanFilesApis/a.ts

@@ -0,0 +1,3 @@
+export default {
+    name: "A"
+};

package/tests/fixtures/scanFilesApis/sub/b.ts

@@ -0,0 +1,3 @@
+export default {
+    name: "B"
+};

package/tests/loadPlugins-order-smoke.test.ts

@@ -0,0 +1,75 @@
+import { describe, expect, test } from "bun:test";
+
+import { loadPlugins } from "../loader/loadPlugins.js";
+
+describe("loadPlugins - order smoke", () => {
+    test("deps 应确保 redis 在 db/cache 之前初始化", async () => {
+        const executed: string[] = [];
+        const ctx: any = {};
+
+        const plugins: any[] = [
+            {
+                moduleName: "db",
+                deps: ["logger", "redis"],
+                handler: async (befly: any) => {
+                    executed.push("db");
+
+                    if (!befly.redis) {
+                        throw new Error("db handler called before redis");
+                    }
+
+                    return { ok: true };
+                }
+            },
+            {
+                moduleName: "cache",
+                deps: ["logger", "redis", "db"],
+                handler: async (befly: any) => {
+                    executed.push("cache");
+
+                    if (!befly.redis) {
+                        throw new Error("cache handler called before redis");
+                    }
+
+                    if (!befly.db) {
+                        throw new Error("cache handler called before db");
+                    }
+
+                    return { ok: true };
+                }
+            },
+            {
+                moduleName: "redis",
+                deps: ["logger"],
+                handler: async (_befly: any) => {
+                    executed.push("redis");
+                    return { ok: true };
+                }
+            },
+            {
+                moduleName: "logger",
+                deps: [],
+                handler: async (_befly: any) => {
+                    executed.push("logger");
+                    return { ok: true };
+                }
+            }
+        ];
+
+        await loadPlugins(plugins as any, ctx as any, []);
+
+        const loggerIndex = executed.indexOf("logger");
+        const redisIndex = executed.indexOf("redis");
+        const dbIndex = executed.indexOf("db");
+        const cacheIndex = executed.indexOf("cache");
+
+        expect(loggerIndex).toBeGreaterThanOrEqual(0);
+        expect(redisIndex).toBeGreaterThanOrEqual(0);
+        expect(dbIndex).toBeGreaterThanOrEqual(0);
+        expect(cacheIndex).toBeGreaterThanOrEqual(0);
+
+        expect(loggerIndex).toBeLessThan(redisIndex);
+        expect(redisIndex).toBeLessThan(dbIndex);
+        expect(dbIndex).toBeLessThan(cacheIndex);
+    });
+});

package/tests/logger.test.ts

@@ -145,7 +145,7 @@ describe("Logger - AsyncLocalStorage 注入", () => {
             {
                 requestId: "rid_1",
                 method: "POST",
-                route: "POST/api/test",
+                route: "/api/test",
                 ip: "127.0.0.1",
                 now: 123,
                 userId: 9,
@@ -160,7 +160,7 @@ describe("Logger - AsyncLocalStorage 注入", () => {
         expect(calls.length).toBe(1);
         expect(calls[0].args[0].requestId).toBe("rid_1");
         expect(calls[0].args[0].method).toBe("POST");
-        expect(calls[0].args[0].route).toBe("POST/api/test");
+        expect(calls[0].args[0].route).toBe("/api/test");
         expect(calls[0].args[0].userId).toBe(9);
         expect(typeof calls[0].args[0].durationSinceNowMs).toBe("number");
         expect(calls[0].args[0].durationSinceNowMs).toBeGreaterThanOrEqual(0);
@@ -190,7 +190,7 @@ describe("Logger - AsyncLocalStorage 注入", () => {
             {
                 requestId: "rid_2",
                 method: "POST",
-                route: "POST/api/test",
+                route: "/api/test",
                 ip: "127.0.0.1",
                 now: 456
             },
@@ -202,7 +202,7 @@ describe("Logger - AsyncLocalStorage 注入", () => {
 
         expect(calls.length).toBe(1);
         expect(calls[0].args[0].requestId).toBe("explicit");
-        expect(calls[0].args[0].route).toBe("POST/api/test");
+        expect(calls[0].args[0].route).toBe("/api/test");
         expect(calls[0].args[0].foo).toBe(1);
         expect(calls[0].args[1]).toBe("m");
     });
@@ -230,7 +230,7 @@ describe("Logger - AsyncLocalStorage 注入", () => {
             {
                 requestId: "rid_3",
                 method: "POST",
-                route: "POST/api/test",
+                route: "/api/test",
                 ip: "127.0.0.1",
                 now: 789
             },
@@ -276,7 +276,7 @@ describe("Logger - AsyncLocalStorage 注入", () => {
             {
                 requestId: "rid_trim",
                 method: "POST",
-                route: "POST/api/test",
+                route: "/api/test",
                 ip: "127.0.0.1",
                 now: 1
             },

package/tests/redisHelper.test.ts

@@ -12,7 +12,12 @@ let redis: RedisHelper;
 
 beforeAll(async () => {
     // 连接 Redis
-    await Connect.connectRedis();
+    await Connect.connectRedis({
+        host: "127.0.0.1",
+        port: 6379,
+        db: 0,
+        prefix: "befly:"
+    });
     redis = new RedisHelper();
 });
 

package/tests/scanFiles-routePath.test.ts

@@ -0,0 +1,46 @@
+import { describe, expect, test } from "bun:test";
+import { fileURLToPath } from "node:url";
+
+import { scanFiles } from "../utils/scanFiles.js";
+
+describe("scanFiles - api routePath formatting", () => {
+    test("routePrefix 应为 /core|/app|/addon 且 routePath 不应出现 /api//", async () => {
+        const fixturesDir = fileURLToPath(new URL("./fixtures/scanFilesApis", import.meta.url));
+        const addonApisDir = fileURLToPath(new URL("./fixtures/scanFilesAddon/node_modules/@befly-addon/demo/apis", import.meta.url));
+
+        const coreApis = await scanFiles(fixturesDir, "core", "api", "**/*.ts");
+        const appApis = await scanFiles(fixturesDir, "app", "api", "**/*.ts");
+        const addonApis = await scanFiles(addonApisDir, "addon", "api", "**/*.ts");
+
+        const all = ([] as any[]).concat(coreApis as any, appApis as any, addonApis as any);
+        expect(all.length).toBeGreaterThan(0);
+
+        for (const api of all) {
+            expect(typeof api.routePrefix).toBe("string");
+            expect(typeof api.routePath).toBe("string");
+
+            if (api.source === "addon") {
+                expect(api.routePrefix.startsWith("/addon/")).toBe(true);
+                expect(typeof api.addonName).toBe("string");
+                expect(api.addonName.length > 0).toBe(true);
+                expect(api.routePrefix).toBe(`/addon/${api.addonName}`);
+            } else {
+                expect(["/core", "/app"].includes(api.routePrefix)).toBe(true);
+            }
+            expect(api.routePath.includes("/api//")).toBe(false);
+        }
+
+        const coreB = (coreApis as any[]).find((item) => item.relativePath === "sub/b");
+        expect(coreB.routePrefix).toBe("/core");
+        expect(coreB.routePath).toBe("/api/core/sub/b");
+
+        const appB = (appApis as any[]).find((item) => item.relativePath === "sub/b");
+        expect(appB.routePrefix).toBe("/app");
+        expect(appB.routePath).toBe("/api/app/sub/b");
+
+        const addonB = (addonApis as any[]).find((item) => item.relativePath === "sub/b");
+        expect(addonB.addonName).toBe("demo");
+        expect(addonB.routePrefix).toBe("/addon/demo");
+        expect(addonB.routePath).toBe("/api/addon/demo/sub/b");
+    });
+});

package/tests/smoke-sql.test.ts

@@ -0,0 +1,24 @@
+import { describe, expect, test } from "bun:test";
+
+import { SqlBuilder } from "../lib/sqlBuilder.js";
+
+describe("smoke - sql", () => {
+    test("SqlBuilder: should build a simple SELECT with params", () => {
+        const qb = new SqlBuilder();
+
+        const result = qb.select(["id", "name"]).from("users").where({ id: 123 }).limit(10).offset(20).toSelectSql();
+
+        expect(result).toBeDefined();
+        expect(typeof result.sql).toBe("string");
+        expect(Array.isArray(result.params)).toBe(true);
+
+        // 关键特征：有 SELECT/FROM/WHERE/LIMIT，且参数化生效
+        expect(result.sql).toContain("SELECT `id`, `name` FROM `users`");
+        expect(result.sql).toContain("WHERE `id` = ?");
+        expect(result.sql).toContain("LIMIT 10 OFFSET 20");
+        expect(result.params).toEqual([123]);
+
+        // 基础安全性：确保 where 使用占位符，而不是把值直接拼进 SQL
+        expect(result.sql).not.toContain("123");
+    });
+});