botversion-sdk 2.2.2 → 2.3.0

package/undo/lib/log.js

@@ -0,0 +1,34 @@
+// lib/log.js
+"use strict";
+// Tiny logger. Rule from the plan: logs may contain table names, operation
+// types, counts and ids only - NEVER row values or SQL text.
+
+const PREFIX = "[botversion-undo-exp]";
+let quiet = false;
+
+function setQuiet(value) {
+  quiet = !!value;
+}
+
+function info(...args) {
+  if (quiet) return;
+}
+
+function warn(...args) {
+  try {
+    console.warn(PREFIX, "WARNING:", ...args);
+  } catch (_) {
+    /* logging must never break the host */
+  }
+}
+
+// TEMP DEBUG: always prints (log.info is silent). Reasons, names and codes only, never row values or SQL.
+function debug(...args) {
+  try {
+    console.log(PREFIX, "[DEBUG]", ...args);
+  } catch (_) {
+    /* logging must never break the host */
+  }
+}
+
+module.exports = { info, warn, debug, setQuiet, PREFIX };

package/undo/lib/mssql-run.js

@@ -0,0 +1,95 @@
+// lib/mssql-run.js
+"use strict";
+// SQL SERVER HELPERS (shared by capture and Undo): runs one statement on a tedious connection and gives back a promise.
+// "copy" = one loaded copy of tedious: { exp: the package exports, fns: { sql, batch } } where fns are the ORIGINAL
+// execSql / execSqlBatch, so the hook never sees the statements sent through here. Logs nothing.
+
+// JS value -> tedious parameter type + value. NULL is typed VarChar because NVarChar NULL cannot convert to binary columns.
+function toParam(v, T) {
+  if (v === undefined || v === null) return { type: T.VarChar, value: null };
+  if (typeof v === "boolean") return { type: T.Bit, value: v };
+  if (typeof v === "number") {
+    if (!Number.isInteger(v)) return { type: T.Float, value: v };
+    return v >= -2147483648 && v <= 2147483647
+      ? { type: T.Int, value: v }
+      : { type: T.BigInt, value: v };
+  }
+  if (typeof v === "bigint") return { type: T.NVarChar, value: v.toString() };
+  if (v instanceof Date)
+    return isNaN(v.getTime())
+      ? { type: T.VarChar, value: null }
+      : { type: T.DateTime2, value: v };
+  if (Buffer.isBuffer(v)) return { type: T.VarBinary, value: v };
+  if (typeof v === "object")
+    return {
+      type: T.NVarChar,
+      value: JSON.stringify(v, (k, x) =>
+        typeof x === "bigint" ? x.toString() : x,
+      ),
+    };
+  return { type: T.NVarChar, value: String(v) };
+}
+
+// tedious gives a row as a list of columns (or an object when useColumnNames is on). Both become { name: value }.
+function normalizeRow(cols) {
+  const o = {};
+  if (Array.isArray(cols)) {
+    for (const c of cols) {
+      const n = c && c.metadata && c.metadata.colName;
+      if (n && !(n in o)) o[n] = c.value;
+    }
+    return o;
+  }
+  for (const k of Object.keys(cols || {})) {
+    const c = cols[k];
+    o[k] = c && typeof c === "object" && "value" in c ? c.value : c;
+  }
+  return o;
+}
+
+// params = plain values, named @P1, @P2...   named = ready tedious parameters { name, type, value, length, precision, scale }.
+// With no parameters the statement is sent as a plain batch (needed for SAVE TRANSACTION and similar).
+function runOn(conn, copy, sql, params, named) {
+  return new Promise((resolve, reject) => {
+    try {
+      const { Request, TYPES } = copy.exp;
+      const rows = [];
+      let settled = false;
+      const req = new Request(sql, (err, rowCount) => {
+        if (settled) return;
+        settled = true;
+        if (err) reject(err);
+        else resolve({ rows, rowCount });
+      });
+      req.on("row", (cols) => {
+        rows.push(normalizeRow(cols));
+      });
+      let any = false;
+      (params || []).forEach((v, i) => {
+        const p = toParam(v, TYPES);
+        req.addParameter("P" + (i + 1), p.type, p.value);
+        any = true;
+      });
+      (named || []).forEach((n) => {
+        const o = {};
+        if (n.length !== undefined) o.length = n.length;
+        if (n.precision !== undefined) o.precision = n.precision;
+        if (n.scale !== undefined) o.scale = n.scale;
+        req.addParameter(n.name, n.type, n.value, o);
+        any = true;
+      });
+      (any ? copy.fns.sql : copy.fns.batch).call(conn, req);
+    } catch (e) {
+      reject(e);
+    }
+  });
+}
+
+// The "run" function the snapshot store expects. dialect tells it to use SQL Server savepoint words.
+function makeRun(conn, copy) {
+  const run = (sql, params, named) => runOn(conn, copy, sql, params, named);
+  run.dialect = "sqlserver";
+  return run;
+}
+
+module.exports = { toParam, normalizeRow, runOn, makeRun };

package/undo/lib/prisma-structure.js

@@ -0,0 +1,397 @@
+// lib/prisma-structure.js
+"use strict";
+// PRIMARY KEYS AND DELETE LINKS, READ FROM THE DATABASE ITSELF
+// Some Prisma versions carry no key markers and no relation rules in the client at runtime, and do not expose
+// the data model either. When that happens, the database is asked instead.
+// Structure only: table and column names, never row data. Never throws: any problem leaves the answers empty,
+// and the caller then blocks the write as before.
+
+const log = require("./log");
+
+const cache = new WeakMap(); // Prisma client -> what was read from its database
+
+// One row per column, so no array types have to be read back through Prisma.
+const SQL = {
+  postgres: {
+    pk:
+      "SELECT cl.relname::text AS tbl, a.attname::text AS col, k.ord::int AS ord " +
+      "FROM pg_index i " +
+      "JOIN pg_class cl ON cl.oid = i.indrelid " +
+      "JOIN pg_namespace n ON n.oid = cl.relnamespace " +
+      "CROSS JOIN LATERAL unnest(i.indkey::int2[]) WITH ORDINALITY AS k(attnum, ord) " +
+      "JOIN pg_attribute a ON a.attrelid = i.indrelid AND a.attnum = k.attnum " +
+      "WHERE i.indisprimary AND n.nspname = current_schema() " +
+      "ORDER BY cl.relname, k.ord",
+    fk:
+      "SELECT c.conname::text AS cname, cl.relname::text AS child_tbl, pc.relname::text AS parent_tbl, " +
+      "c.confdeltype::text AS rule, ca.attname::text AS child_col, pa.attname::text AS parent_col, k.ord::int AS ord " +
+      "FROM pg_constraint c " +
+      "JOIN pg_class cl ON cl.oid = c.conrelid " +
+      "JOIN pg_namespace n ON n.oid = cl.relnamespace " +
+      "JOIN pg_class pc ON pc.oid = c.confrelid " +
+      "JOIN pg_namespace pn ON pn.oid = pc.relnamespace " +
+      "CROSS JOIN LATERAL unnest(c.conkey, c.confkey) WITH ORDINALITY AS k(ckey, pkey, ord) " +
+      "JOIN pg_attribute ca ON ca.attrelid = c.conrelid AND ca.attnum = k.ckey " +
+      "JOIN pg_attribute pa ON pa.attrelid = c.confrelid AND pa.attnum = k.pkey " +
+      "WHERE c.contype = 'f' AND n.nspname = current_schema() AND pn.nspname = current_schema() " +
+      "ORDER BY c.conname, k.ord",
+  },
+  mysql: {
+    pk:
+      "SELECT k.TABLE_NAME AS tbl, k.COLUMN_NAME AS col, k.ORDINAL_POSITION AS ord " +
+      "FROM information_schema.KEY_COLUMN_USAGE k " +
+      "WHERE k.TABLE_SCHEMA = DATABASE() AND k.CONSTRAINT_NAME = 'PRIMARY' " +
+      "ORDER BY k.TABLE_NAME, k.ORDINAL_POSITION",
+    fk:
+      "SELECT k.CONSTRAINT_NAME AS cname, k.TABLE_NAME AS child_tbl, k.REFERENCED_TABLE_NAME AS parent_tbl, " +
+      "r.DELETE_RULE AS rule, k.COLUMN_NAME AS child_col, k.REFERENCED_COLUMN_NAME AS parent_col, k.ORDINAL_POSITION AS ord " +
+      "FROM information_schema.KEY_COLUMN_USAGE k " +
+      "JOIN information_schema.REFERENTIAL_CONSTRAINTS r ON r.CONSTRAINT_SCHEMA = k.CONSTRAINT_SCHEMA " +
+      "AND r.CONSTRAINT_NAME = k.CONSTRAINT_NAME AND r.TABLE_NAME = k.TABLE_NAME " +
+      "WHERE k.TABLE_SCHEMA = DATABASE() AND k.REFERENCED_TABLE_NAME IS NOT NULL " +
+      "ORDER BY k.CONSTRAINT_NAME, k.ORDINAL_POSITION",
+  },
+  sqlserver: {
+    pk:
+      "SELECT t.name AS tbl, c.name AS col, ic.key_ordinal AS ord " +
+      "FROM sys.indexes i " +
+      "JOIN sys.tables t ON t.object_id = i.object_id " +
+      "JOIN sys.index_columns ic ON ic.object_id = i.object_id AND ic.index_id = i.index_id " +
+      "JOIN sys.columns c ON c.object_id = ic.object_id AND c.column_id = ic.column_id " +
+      "WHERE i.is_primary_key = 1 AND t.schema_id = SCHEMA_ID() " +
+      "ORDER BY t.name, ic.key_ordinal",
+    fk:
+      "SELECT fk.name AS cname, tc.name AS child_tbl, tp.name AS parent_tbl, " +
+      "fk.delete_referential_action_desc AS rule, cc.name AS child_col, pc.name AS parent_col, " +
+      "fkc.constraint_column_id AS ord " +
+      "FROM sys.foreign_keys fk " +
+      "JOIN sys.tables tc ON tc.object_id = fk.parent_object_id " +
+      "JOIN sys.tables tp ON tp.object_id = fk.referenced_object_id " +
+      "JOIN sys.foreign_key_columns fkc ON fkc.constraint_object_id = fk.object_id " +
+      "JOIN sys.columns cc ON cc.object_id = fkc.parent_object_id AND cc.column_id = fkc.parent_column_id " +
+      "JOIN sys.columns pc ON pc.object_id = fkc.referenced_object_id AND pc.column_id = fkc.referenced_column_id " +
+      "WHERE tc.schema_id = SCHEMA_ID() AND tp.schema_id = SCHEMA_ID() " +
+      "ORDER BY fk.name, fkc.constraint_column_id",
+  },
+  sqlite: {
+    pk:
+      "SELECT m.name AS tbl, p.name AS col, p.pk AS ord " +
+      "FROM sqlite_master m JOIN pragma_table_info(m.name) p " +
+      "WHERE m.type = 'table' AND m.name NOT LIKE 'sqlite_%' AND p.pk > 0 " +
+      "ORDER BY m.name, p.pk",
+    // "to" is empty when the link points at the parent's primary key without naming it: the key column at the same position is used.
+    fk:
+      'SELECT m.name AS child_tbl, CAST(f.id AS TEXT) AS cname, f."table" AS parent_tbl, ' +
+      'f.on_delete AS rule, f."from" AS child_col, ' +
+      'COALESCE(f."to", (SELECT p2.name FROM pragma_table_info(f."table") p2 WHERE p2.pk = f.seq + 1)) AS parent_col, ' +
+      "f.seq AS ord " +
+      "FROM sqlite_master m JOIN pragma_foreign_key_list(m.name) f " +
+      "WHERE m.type = 'table' AND m.name NOT LIKE 'sqlite_%' " +
+      "ORDER BY m.name, f.id, f.seq",
+  },
+};
+
+// The database's own delete rule, in the words the capture code already uses.
+const RULES = {
+  postgres: {
+    c: "Cascade",
+    n: "SetNull",
+    d: "SetDefault",
+    a: "NoAction",
+    r: "Restrict",
+  },
+  mysql: {
+    CASCADE: "Cascade",
+    "SET NULL": "SetNull",
+    "SET DEFAULT": "SetDefault",
+    RESTRICT: "Restrict",
+    "NO ACTION": "NoAction",
+  },
+  // SQL Server's words use underscores.
+  sqlserver: {
+    CASCADE: "Cascade",
+    SET_NULL: "SetNull",
+    SET_DEFAULT: "SetDefault",
+    NO_ACTION: "NoAction",
+  },
+};
+// SQLite uses the same words as MySQL.
+RULES.sqlite = RULES.mysql;
+
+function ruleOf(dialect, raw) {
+  // Postgres rules are single lowercase letters; every other database gives words, matched in capitals.
+  const key = dialect === "postgres" ? String(raw) : String(raw).toUpperCase();
+  return (RULES[dialect] && RULES[dialect][key]) || null;
+}
+
+const byOrd = (a, b) => a.ord - b.ord;
+
+async function read(base, dialect, st) {
+  const sql = SQL[dialect];
+  if (!sql) {
+    log.debug(
+      "prisma-structure: reading keys from the database is not available for",
+      String(dialect),
+    );
+    return false; // stays cached: asking again would give the same answer
+  }
+  try {
+    const pkRows = await base.$queryRawUnsafe(sql.pk);
+    const fkRows = await base.$queryRawUnsafe(sql.fk);
+
+    const pk = new Map();
+    for (const r of pkRows) {
+      const t = String(r.tbl);
+      if (!pk.has(t)) pk.set(t, []);
+      pk.get(t).push({ col: String(r.col), ord: Number(r.ord) });
+    }
+    st.pk = new Map();
+    for (const [t, list] of pk)
+      st.pk.set(
+        t,
+        list.sort(byOrd).map((x) => x.col),
+      );
+
+    const links = new Map();
+    let badRule = false;
+    for (const r of fkRows) {
+      const key = String(r.child_tbl) + "\u0002" + String(r.cname);
+      const rule = ruleOf(dialect, r.rule);
+      if (!rule) badRule = true;
+      if (!links.has(key))
+        links.set(key, {
+          child: String(r.child_tbl),
+          parent: String(r.parent_tbl),
+          rule,
+          cols: [],
+        });
+      links.get(key).cols.push({
+        c: String(r.child_col),
+        p: String(r.parent_col),
+        ord: Number(r.ord),
+      });
+    }
+    st.fks = [...links.values()].map((l) => {
+      const cols = l.cols.sort(byOrd);
+      return {
+        child: l.child,
+        parent: l.parent,
+        rule: l.rule,
+        childCols: cols.map((x) => x.c),
+        parentCols: cols.map((x) => x.p),
+      };
+    });
+    st.badRule = badRule;
+    st.ready = true;
+    log.debug(
+      "prisma-structure loaded:",
+      "dialect=" + dialect,
+      "tablesWithKeys=" + st.pk.size,
+      "foreignKeys=" + st.fks.length,
+      "unknownRules=" + badRule,
+    );
+    return true;
+  } catch (e) {
+    st.promise = null; // try again on the next write
+    log.debug(
+      "prisma-structure failed:",
+      "name=" + (e && e.name),
+      "code=" + ((e && e.code) || "none"),
+      "dbCode=" + ((e && e.meta && e.meta.code) || "none"),
+    );
+    return false;
+  }
+}
+
+// Reads the structure once per Prisma client. Safe to call many times; never rejects.
+function load(base, dialect) {
+  try {
+    if (!base || typeof base.$queryRawUnsafe !== "function") {
+      log.debug(
+        "prisma-structure: client unusable:",
+        "hasBase=" + !!base,
+        "hasQueryRaw=" + !!(base && typeof base.$queryRawUnsafe === "function"),
+      );
+      return Promise.resolve(false);
+    }
+    let st = cache.get(base);
+    if (!st) {
+      st = {
+        promise: null,
+        ready: false,
+        badRule: false,
+        pk: new Map(),
+        fks: [],
+      };
+      cache.set(base, st);
+    }
+    if (!st.promise) st.promise = read(base, dialect, st);
+    return st.promise;
+  } catch (e) {
+    log.debug("prisma-structure: load threw:", "name=" + (e && e.name));
+    return Promise.resolve(false);
+  }
+}
+
+// Primary key of a table as Prisma FIELD names, in key order. Empty when unknown (the caller then blocks the write).
+function primaryKeyFields(base, table, scalars) {
+  try {
+    const st = cache.get(base);
+    if (!st || !st.ready) return [];
+    const cols = st.pk.get(table);
+    if (!cols || !cols.length) return [];
+    const out = [];
+    for (const c of cols) {
+      const f = scalars.find((x) => (x.dbName || x.name) === c);
+      if (!f) return []; // a key column Prisma does not know: do not guess
+      out.push(f.name);
+    }
+    return out;
+  } catch (_) {
+    return [];
+  }
+}
+
+// Delete links in the same shape the schema reader gives: parent model -> [{ child, rule, fromFields, toFields }].
+// Returns null when the links cannot be trusted (the caller then blocks the write).
+function deleteGraph(base) {
+  try {
+    const st = cache.get(base);
+    if (!st || !st.ready || st.badRule) return null;
+    const models = base._runtimeDataModel && base._runtimeDataModel.models;
+    if (!models) return null;
+    const names = Object.keys(models);
+
+    // Relations Prisma emulates itself leave no foreign keys in the database: with none found, the delete rules cannot be seen.
+    const hasRelations = names.some((n) =>
+      (models[n].fields || []).some((f) => f.kind === "object"),
+    );
+    if (hasRelations && st.fks.length === 0) return null;
+
+    const modelOf = new Map(); // table -> model name
+    for (const n of names) modelOf.set(models[n].dbName || n, n);
+    const fieldOf = (model, col) => {
+      const f = (models[model].fields || []).find(
+        (x) =>
+          (x.kind === "scalar" || x.kind === "enum") &&
+          (x.dbName || x.name) === col,
+      );
+      return f ? f.name : null;
+    };
+
+    const graph = new Map();
+    let links = 0;
+    let skipped = 0;
+    for (const fk of st.fks) {
+      const child = modelOf.get(fk.child);
+      const parent = modelOf.get(fk.parent);
+      if (!child || !parent) {
+        skipped++; // a table Prisma has no model for (for example a hidden many-to-many link table)
+        continue;
+      }
+      const from = fk.childCols.map((c) => fieldOf(child, c));
+      const to = fk.parentCols.map((c) => fieldOf(parent, c));
+      if (from.includes(null) || to.includes(null)) return null; // a column Prisma does not know: do not guess
+      if (!graph.has(parent)) graph.set(parent, []);
+      graph
+        .get(parent)
+        .push({ child, rule: fk.rule, fromFields: from, toFields: to });
+      links++;
+    }
+    if (!st.graphLogged) {
+      st.graphLogged = true;
+      log.debug(
+        "prisma-structure delete links built:",
+        "parents=" + graph.size,
+        "links=" + links,
+        "skippedNoModel=" + skipped,
+      );
+    }
+    return graph;
+  } catch (_) {
+    return null;
+  }
+}
+
+// DEBUG ONLY: names of database tables that have foreign keys and whose name contains the given text (names only).
+function tablesMentioning(base, text) {
+  try {
+    const st = cache.get(base);
+    if (!st || !st.ready || !text) return [];
+    const needle = String(text).toLowerCase();
+    const names = new Set(st.fks.map((fk) => fk.child));
+    return [...names].filter((n) => n.toLowerCase().includes(needle));
+  } catch (_) {
+    return [];
+  }
+}
+
+// True when the relation is stored in a hidden join table whose two foreign keys both cascade on delete.
+function hiddenJoinIsCascade(base, relationName, tableA, tableB) {
+  try {
+    const st = cache.get(base);
+    if (!st || !st.ready || st.badRule || !relationName) return false;
+    const fks = st.fks.filter((fk) => fk.child === "_" + relationName);
+    if (fks.length !== 2) return false;
+    if (!fks.every((fk) => fk.rule === "Cascade")) return false;
+    const parents = fks
+      .map((fk) => fk.parent)
+      .sort()
+      .join("|");
+    return parents === [tableA, tableB].sort().join("|");
+  } catch (_) {
+    return false;
+  }
+}
+
+// True when the relation is stored in a hidden join table whose two foreign keys both cascade on delete.
+function hiddenJoinIsCascade(base, relationName, tableA, tableB) {
+  try {
+    const st = cache.get(base);
+    if (!st || !st.ready || st.badRule || !relationName) return false;
+    const fks = st.fks.filter((fk) => fk.child === "_" + relationName);
+    if (fks.length !== 2) return false;
+    if (!fks.every((fk) => fk.rule === "Cascade")) return false;
+    const parents = fks
+      .map((fk) => fk.parent)
+      .sort()
+      .join("|");
+    return parents === [tableA, tableB].sort().join("|");
+  } catch (_) {
+    return false;
+  }
+}
+
+// DEBUG ONLY: foreign keys (child, parent, delete rule, columns) of tables whose name contains the text. Names only.
+function linksOfTablesMentioning(base, text) {
+  try {
+    const st = cache.get(base);
+    if (!st || !st.ready || !text) return [];
+    const needle = String(text).toLowerCase();
+    return st.fks
+      .filter((fk) => fk.child.toLowerCase().includes(needle))
+      .map(
+        (fk) =>
+          fk.child +
+          "->" +
+          fk.parent +
+          " rule=" +
+          fk.rule +
+          " cols=" +
+          fk.childCols.join("+") +
+          "=>" +
+          fk.parentCols.join("+"),
+      );
+  } catch (_) {
+    return [];
+  }
+}
+
+module.exports = {
+  load,
+  primaryKeyFields,
+  deleteGraph,
+  tablesMentioning,
+  linksOfTablesMentioning,
+  hiddenJoinIsCascade,
+};

package/undo/lib/report.js

@@ -0,0 +1,50 @@
+// lib/report.js
+"use strict";
+// Turns a scan result into the plain-language terminal report.
+
+const log = require("./log");
+const { buildSnapshotTableMessage } = require("./snapshot-sql");
+
+// Prints the database structure summary: tables without a primary key, and what a delete also touches.
+function printStructure(s) {
+  const st = s.structure;
+  if (!st) return;
+  if (!st.ok) {
+    return;
+  }
+
+  const names = (arr) => [...new Set(arr)].join(", ");
+
+  const noPk = st.tables
+    .filter((t) => t.primaryKey.length === 0)
+    .map((t) => t.table);
+
+  // What deleting a row in a table also does to the rows that point to it.
+  const parents = new Map();
+  for (const l of st.links) {
+    if (!parents.has(l.parent)) parents.set(l.parent, { del: [], clear: [] });
+    if (l.rule === "Cascade") parents.get(l.parent).del.push(l.child);
+    else if (l.rule === "SetNull" || l.rule === "SetDefault")
+      parents.get(l.parent).clear.push(l.child);
+  }
+  for (const p of [...parents.keys()].sort()) {
+    const e = parents.get(p);
+    if (!e.del.length && !e.clear.length) continue;
+    const parts = [];
+    if (e.del.length) parts.push("also deletes rows in " + names(e.del));
+    if (e.clear.length) parts.push("changes the link in " + names(e.clear));
+  }
+
+  const blocking = st.links.filter(
+    (l) => l.rule === "Restrict" || l.rule === "NoAction",
+  ).length;
+  const assumed = st.links.filter((l) => !l.explicit).length;
+}
+
+function printReport(s, extra) {
+  const line = "-".repeat(64);
+
+  printStructure(s);
+}
+
+module.exports = { printReport };

package/undo/lib/requester.js

@@ -0,0 +1,33 @@
+// lib/requester.js
+"use strict";
+// Requester check: a per-browser-session secret, sent by the widget in a header.
+// Only a hash of it is ever kept. The secret itself is never stored or logged.
+const crypto = require("crypto");
+
+const HEADER = "x-botversion-requester";
+
+// Returns the hash of the secret in these headers, or null if missing or of the wrong shape.
+function fromHeaders(headers) {
+  try {
+    const raw = headers && headers[HEADER];
+    const v = Array.isArray(raw) ? raw[0] : raw;
+    if (typeof v !== "string" || !/^[A-Za-z0-9_-]{22,128}$/.test(v))
+      return null;
+    return crypto
+      .createHash("sha256")
+      .update("botversion-requester-v1:" + v)
+      .digest("hex");
+  } catch (_) {
+    return null;
+  }
+}
+
+// Constant-time comparison of two hashes.
+function same(a, b) {
+  if (typeof a !== "string" || typeof b !== "string") return false;
+  const x = Buffer.from(a);
+  const y = Buffer.from(b);
+  return x.length === y.length && crypto.timingSafeEqual(x, y);
+}
+
+module.exports = { HEADER, fromHeaders, same };