cdk-rds-sql 9.1.1 → 9.1.2

package/.jsii

@@ -11289,6 +11289,6 @@
       "symbolId": "src/sql:SqlProps"
     }
   },
-  "version": "9.1.1",
-  "fingerprint": "2JVR5sakEHON6uTnca6xJrBAe9ezH/4hFD1HtuE7yxg="
+  "version": "9.1.2",
+  "fingerprint": "DOvwHf5DkaTFsOXeSwFamf8PiOcAMMtjOeFmJ2ALNG4="
 }

package/lib/database.js

@@ -14,7 +14,7 @@ class ImportedDatabase extends constructs_1.Construct {
     }
 }
 class Database extends aws_cdk_lib_1.CustomResource {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-rds-sql.Database", version: "9.1.1" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-rds-sql.Database", version: "9.1.2" };
     /**
      * Return a Database based upon name only. Use for importing existing databases.
      */

package/lib/handler/index.js

@@ -27144,6 +27144,13 @@ var AbstractEngine = class {
     this.log = process.env.LOGGER === "true" ? console.debug : (_message, ..._optionalParams) => {
     };
   }
+  /**
+   * Load connection state required before SQL is rendered.
+   * MySQL literal escaping depends on the session SQL mode, so the handler
+   * calls this before create/update/delete SQL is built.
+   */
+  async prepare(_config) {
+  }
   /**
    * Parse password field from secret. Returns void on error or if no password field exists.
    */
@@ -27414,11 +27421,78 @@ var DsqlEngine = class extends AbstractEngine {
 
 // lambda/engine.mysql.ts
 var fs = __toESM(require("fs"));
+
+// lambda/mysql-quote.ts
+var NO_BACKSLASH_ESCAPES = "NO_BACKSLASH_ESCAPES";
+function quoteMysqlIdentifier(identifier) {
+  return `\`${identifier.replaceAll("`", "``")}\``;
+}
+function quoteMysqlString(value, sqlMode) {
+  const noBackslashEscapes = sqlMode.split(",").some((mode) => mode.trim() === NO_BACKSLASH_ESCAPES);
+  let quoted = "";
+  for (const char of value) {
+    if (char === "'") {
+      quoted += "''";
+      continue;
+    }
+    if (!noBackslashEscapes) {
+      const escaped = backslashEscape(char);
+      if (escaped !== void 0) {
+        quoted += escaped;
+        continue;
+      }
+    }
+    quoted += char;
+  }
+  return `'${quoted}'`;
+}
+function backslashEscape(char) {
+  switch (char) {
+    case "\\":
+      return "\\\\";
+    case "\0":
+      return "\\0";
+    case "\b":
+      return "\\b";
+    case "\n":
+      return "\\n";
+    case "\r":
+      return "\\r";
+    case "	":
+      return "\\t";
+    case "":
+      return "\\Z";
+    default:
+      return void 0;
+  }
+}
+
+// lambda/engine.mysql.ts
 var MysqlEngine = class extends AbstractEngine {
+  /**
+   * Session SQL mode used to quote literals. Empty means MySQL's default
+   * (backslash escapes enabled) so unit tests can render SQL without a
+   * connection. Production replaces this from @@SESSION.sql_mode.
+   */
+  sqlMode = "";
+  /** Visible to tests. Production sets this from the live session in prepare(). */
+  setSqlMode(sqlMode) {
+    this.sqlMode = sqlMode;
+  }
+  async prepare(config) {
+    const connection = await this.openConnection(config);
+    try {
+      const [rows] = await connection.query("SELECT @@SESSION.sql_mode AS sqlMode");
+      this.sqlMode = readSqlMode(rows);
+      this.log(`MySQL session sql_mode is ${this.sqlMode === "" ? "(empty)" : this.sqlMode}`);
+    } finally {
+      await connection.end();
+    }
+  }
   createDatabase(resourceId, props) {
-    const sql = [`CREATE DATABASE IF NOT EXISTS \`${resourceId}\``];
+    const sql = [`CREATE DATABASE IF NOT EXISTS ${quoteMysqlIdentifier(resourceId)}`];
     if (props.Owner) {
-      sql.push(`GRANT ALL PRIVILEGES ON \`${resourceId}\`.* TO '${props.Owner}'@'%'`);
+      sql.push(this.grantDatabase(resourceId, props.Owner));
       sql.push("FLUSH PRIVILEGES");
     }
     return sql;
@@ -27427,24 +27501,22 @@ var MysqlEngine = class extends AbstractEngine {
     throw new Error("Renaming database is not supported in MySQL.");
   }
   deleteDatabase(resourceId, _masterUser) {
-    return [`DROP DATABASE IF EXISTS \`${resourceId}\``];
+    return [`DROP DATABASE IF EXISTS ${quoteMysqlIdentifier(resourceId)}`];
   }
   async createRole(resourceId, props) {
     const sql = [];
     if (props.EnableIamAuth) {
-      sql.push(
-        `CREATE USER IF NOT EXISTS '${resourceId}'@'%' IDENTIFIED WITH AWSAuthenticationPlugin as 'RDS'`
-      );
+      sql.push(this.iamUser(resourceId, true));
     } else {
       if (!props.PasswordArn) throw new Error("No PasswordArn provided");
       const password = await this.getPassword(props.PasswordArn);
       if (!password) throw `Cannot parse password from ${props.PasswordArn}`;
-      sql.push(`CREATE USER IF NOT EXISTS '${resourceId}'@'%' IDENTIFIED BY '${password}'`);
+      sql.push(this.passwordUser(resourceId, password, true));
     }
     if (props.DatabaseName) {
-      sql.push(`GRANT ALL PRIVILEGES ON \`${props.DatabaseName}\`.* TO '${resourceId}'@'%'`);
+      sql.push(this.grantDatabase(props.DatabaseName, resourceId));
     }
-    appendMaxUserConnections(sql, resourceId, props.MaxUserConnections);
+    appendMaxUserConnections(sql, this.account(resourceId), props.MaxUserConnections);
     sql.push("FLUSH PRIVILEGES");
     return sql;
   }
@@ -27452,42 +27524,40 @@ var MysqlEngine = class extends AbstractEngine {
     const sql = [];
     if (oldResourceId !== resourceId) {
       if (props.EnableIamAuth) {
-        sql.push(
-          `CREATE USER IF NOT EXISTS '${resourceId}'@'%' IDENTIFIED WITH AWSAuthenticationPlugin as 'RDS'`
-        );
+        sql.push(this.iamUser(resourceId, true));
       } else if (props?.PasswordArn) {
         const password = await this.getPassword(props.PasswordArn);
         if (!password) throw `Cannot parse password from ${props.PasswordArn}`;
-        sql.push(`CREATE USER IF NOT EXISTS '${resourceId}'@'%' IDENTIFIED BY '${password}'`);
+        sql.push(this.passwordUser(resourceId, password, true));
       } else {
-        sql.push(`CREATE USER IF NOT EXISTS '${resourceId}'@'%' IDENTIFIED BY UUID()`);
-        sql.push(`ALTER USER '${resourceId}'@'%' PASSWORD EXPIRE`);
+        sql.push(`CREATE USER IF NOT EXISTS ${this.account(resourceId)} IDENTIFIED BY UUID()`);
+        sql.push(`ALTER USER ${this.account(resourceId)} PASSWORD EXPIRE`);
       }
-      sql.push(`DROP USER IF EXISTS '${oldResourceId}'@'%'`);
+      sql.push(`DROP USER IF EXISTS ${this.account(oldResourceId)}`);
     } else {
       if (props?.EnableIamAuth && !oldProps?.EnableIamAuth) {
-        sql.push(`DROP USER IF EXISTS '${resourceId}'@'%'`);
-        sql.push(`CREATE USER '${resourceId}'@'%' IDENTIFIED WITH AWSAuthenticationPlugin as 'RDS'`);
+        sql.push(`DROP USER IF EXISTS ${this.account(resourceId)}`);
+        sql.push(this.iamUser(resourceId, false));
       } else if (!props?.EnableIamAuth && oldProps?.EnableIamAuth) {
-        sql.push(`DROP USER IF EXISTS '${resourceId}'@'%'`);
+        sql.push(`DROP USER IF EXISTS ${this.account(resourceId)}`);
         if (props?.PasswordArn) {
           const password = await this.getPassword(props.PasswordArn);
           if (!password) throw `Cannot parse password from ${props.PasswordArn}`;
-          sql.push(`CREATE USER '${resourceId}'@'%' IDENTIFIED BY '${password}'`);
+          sql.push(this.passwordUser(resourceId, password, false));
         }
       } else if (!props?.EnableIamAuth && props?.PasswordArn) {
         const password = await this.getPassword(props.PasswordArn);
         if (!password) throw `Cannot parse password from ${props.PasswordArn}`;
-        sql.push(`ALTER USER '${resourceId}'@'%' IDENTIFIED BY '${password}'`);
+        sql.push(`ALTER USER ${this.account(resourceId)} IDENTIFIED BY ${this.literal(password)}`);
       }
     }
     if (oldProps?.DatabaseName && props?.DatabaseName && oldProps.DatabaseName !== props.DatabaseName) {
-      sql.push(`REVOKE ALL PRIVILEGES ON \`${oldProps.DatabaseName}\`.* FROM '${resourceId}'@'%'`);
+      sql.push(this.revokeDatabase(oldProps.DatabaseName, resourceId));
     }
     if (props?.DatabaseName) {
-      sql.push(`GRANT ALL PRIVILEGES ON \`${props.DatabaseName}\`.* TO '${resourceId}'@'%'`);
+      sql.push(this.grantDatabase(props.DatabaseName, resourceId));
     }
-    appendMaxUserConnections(sql, resourceId, props.MaxUserConnections);
+    appendMaxUserConnections(sql, this.account(resourceId), props.MaxUserConnections);
     if (sql.length > 0) {
       sql.push("FLUSH PRIVILEGES");
     }
@@ -27496,9 +27566,9 @@ var MysqlEngine = class extends AbstractEngine {
   async deleteRole(resourceId, props) {
     const sql = [];
     if (props?.DatabaseName) {
-      sql.push(`REVOKE ALL PRIVILEGES ON \`${props.DatabaseName}\`.* FROM '${resourceId}'@'%'`);
+      sql.push(this.revokeDatabase(props.DatabaseName, resourceId));
     }
-    sql.push(`DROP USER IF EXISTS '${resourceId}'@'%'`);
+    sql.push(`DROP USER IF EXISTS ${this.account(resourceId)}`);
     sql.push("FLUSH PRIVILEGES");
     return sql;
   }
@@ -27530,6 +27600,48 @@ var MysqlEngine = class extends AbstractEngine {
     throw new Error("IAM grants are only supported with DSQL clusters");
   }
   async executeSQL(sql, config) {
+    const isSslEnabled = process.env.SSL ? JSON.parse(process.env.SSL) : true;
+    const connection = await this.openConnection(config);
+    this.log(
+      `Connecting to MySQL/MariaDB host ${config.host}:${config.port}${isSslEnabled ? " using a secure connection" : ""}, database ${config.database} as ${config.user}`
+    );
+    this.log("Executing SQL", sql);
+    try {
+      if (typeof sql === "string") {
+        return await connection.query(sql);
+      } else if (sql) {
+        return await Promise.all(sql.map((statement) => connection.query(statement)));
+      }
+    } finally {
+      await connection.end();
+    }
+  }
+  literal(value) {
+    return quoteMysqlString(value, this.sqlMode);
+  }
+  /** Account name as a string literal. The host is the fixed VPC wildcard. */
+  account(user) {
+    return `${this.literal(user)}@'%'`;
+  }
+  iamUser(user, ifNotExists) {
+    const exists = ifNotExists ? "IF NOT EXISTS " : "";
+    const account = this.account(user);
+    return `CREATE USER ${exists}${account} IDENTIFIED WITH AWSAuthenticationPlugin as 'RDS'`;
+  }
+  passwordUser(user, password, ifNotExists) {
+    const exists = ifNotExists ? "IF NOT EXISTS " : "";
+    const account = this.account(user);
+    return `CREATE USER ${exists}${account} IDENTIFIED BY ${this.literal(password)}`;
+  }
+  grantDatabase(databaseName, user) {
+    const database = quoteMysqlIdentifier(databaseName);
+    return `GRANT ALL PRIVILEGES ON ${database}.* TO ${this.account(user)}`;
+  }
+  revokeDatabase(databaseName, user) {
+    const database = quoteMysqlIdentifier(databaseName);
+    return `REVOKE ALL PRIVILEGES ON ${database}.* FROM ${this.account(user)}`;
+  }
+  async openConnection(config) {
     const { createConnection } = await Promise.resolve().then(() => __toESM(require_promise()));
     const isSslEnabled = process.env.SSL ? JSON.parse(process.env.SSL) : true;
     const sslOptions = isSslEnabled ? {
@@ -27538,7 +27650,7 @@ var MysqlEngine = class extends AbstractEngine {
         rejectUnauthorized: true
       }
     } : {};
-    const connectionConfig = {
+    return createConnection({
       host: config.host,
       port: config.port,
       user: config.user,
@@ -27547,31 +27659,30 @@ var MysqlEngine = class extends AbstractEngine {
       connectTimeout: 3e4,
       multipleStatements: true,
       ...sslOptions
-    };
-    this.log(
-      `Connecting to MySQL/MariaDB host ${connectionConfig.host}:${connectionConfig.port}${isSslEnabled ? " using a secure connection" : ""}, database ${connectionConfig.database} as ${connectionConfig.user}`
-    );
-    this.log("Executing SQL", sql);
-    const connection = await createConnection(connectionConfig);
-    try {
-      if (typeof sql === "string") {
-        return await connection.query(sql);
-      } else if (sql) {
-        return await Promise.all(sql.map((statement) => connection.query(statement)));
-      }
-    } finally {
-      await connection.end();
-    }
+    });
   }
 };
-function appendMaxUserConnections(sql, resourceId, maxUserConnections) {
+function appendMaxUserConnections(sql, account, maxUserConnections) {
   if (maxUserConnections === void 0) {
     return;
   }
   if (!Number.isInteger(maxUserConnections) || maxUserConnections < 0) {
     throw new Error(`MaxUserConnections must be a non-negative integer, got ${maxUserConnections}`);
   }
-  sql.push(`ALTER USER '${resourceId}'@'%' WITH MAX_USER_CONNECTIONS ${maxUserConnections}`);
+  sql.push(`ALTER USER ${account} WITH MAX_USER_CONNECTIONS ${maxUserConnections}`);
+}
+function readSqlMode(rows) {
+  if (!Array.isArray(rows) || rows.length !== 1) {
+    throw new Error("MySQL did not return a session sql_mode");
+  }
+  const row = rows[0];
+  if (!isSqlModeRow(row)) {
+    throw new Error("MySQL did not return a session sql_mode");
+  }
+  return row.sqlMode;
+}
+function isSqlModeRow(row) {
+  return typeof row === "object" && row !== null && "sqlMode" in row && typeof row.sqlMode === "string";
 }
 
 // lambda/engine.postgresql.ts
@@ -27942,6 +28053,30 @@ var handler = async (event) => {
     engine = secretValues.engine || "postgresql";
   }
   const dbEngine = EngineFactory.createEngine(engine);
+  let database;
+  if (engine === "dsql") {
+    database = "postgres";
+  } else if (resource === "role" /* ROLE */) {
+    database = secretValues.dbname;
+  } else {
+    database = databaseName ?? secretValues.dbname;
+  }
+  const config = {
+    host: secretValues.host,
+    port: secretValues.port,
+    user: secretValues.username,
+    password: secretValues.password || "",
+    // DSQL will generate token in engine
+    database
+  };
+  if (resource !== "parameter_password" /* PARAMETER_PASSWORD */) {
+    try {
+      await dbEngine.prepare(config);
+    } catch (error) {
+      log("Error preparing database connection: %o", error);
+      throw error;
+    }
+  }
   let sql;
   switch (requestType) {
     case "Create": {
@@ -28050,22 +28185,6 @@ var handler = async (event) => {
     }
   }
   if (sql) {
-    let database;
-    if (engine === "dsql") {
-      database = "postgres";
-    } else if (resource === "role" /* ROLE */) {
-      database = secretValues.dbname;
-    } else {
-      database = databaseName ?? secretValues.dbname;
-    }
-    const config = {
-      host: secretValues.host,
-      port: secretValues.port,
-      user: secretValues.username,
-      password: secretValues.password || "",
-      // DSQL will generate token in engine
-      database
-    };
     try {
       await (0, import_exponential_backoff.backOff)(
         async () => {

package/lib/iam-grant.js

@@ -6,7 +6,7 @@ const aws_cdk_lib_1 = require("aws-cdk-lib");
 const enum_1 = require("./enum");
 const provider_1 = require("./provider");
 class IamGrant extends aws_cdk_lib_1.CustomResource {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-rds-sql.IamGrant", version: "9.1.1" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-rds-sql.IamGrant", version: "9.1.2" };
     constructor(scope, id, props) {
         // IAM grants are only supported on DSQL
         if (props.provider.engine !== provider_1.DatabaseEngine.DSQL) {

package/lib/provider.js

@@ -60,7 +60,7 @@ var DatabaseEngine;
     DatabaseEngine["DSQL"] = "dsql";
 })(DatabaseEngine || (exports.DatabaseEngine = DatabaseEngine = {}));
 class Provider extends constructs_1.Construct {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-rds-sql.Provider", version: "9.1.1" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-rds-sql.Provider", version: "9.1.2" };
     /**
      * Import an existing provider Lambda function
      */

package/lib/role.js

@@ -83,7 +83,7 @@ class Parameters extends constructs_1.Construct {
     }
 }
 class Role extends constructs_1.Construct {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-rds-sql.Role", version: "9.1.1" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-rds-sql.Role", version: "9.1.2" };
     /**
      * The role name.
      */

package/lib/schema.js

@@ -5,7 +5,7 @@ const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
 const aws_cdk_lib_1 = require("aws-cdk-lib");
 const enum_1 = require("./enum");
 class Schema extends aws_cdk_lib_1.CustomResource {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-rds-sql.Schema", version: "9.1.1" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-rds-sql.Schema", version: "9.1.2" };
     schemaName;
     constructor(scope, id, props) {
         super(scope, id, {

package/lib/sql.js

@@ -5,7 +5,7 @@ const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
 const aws_cdk_lib_1 = require("aws-cdk-lib");
 const enum_1 = require("./enum");
 class Sql extends aws_cdk_lib_1.CustomResource {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-rds-sql.Sql", version: "9.1.1" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "cdk-rds-sql.Sql", version: "9.1.2" };
     constructor(scope, id, props) {
         super(scope, id, {
             serviceToken: props.provider.serviceToken,

package/package.json

@@ -75,7 +75,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "9.1.1",
+  "version": "9.1.2",
   "jest": {
     "coverageProvider": "v8",
     "testMatch": [