efarmz-slackbot-data 1.0.0

package/src/infrastructure/sql/RegexSqlValidator.test.ts

@@ -0,0 +1,242 @@
+import { describe, it, expect } from "vitest";
+import RegexSqlValidator from "./RegexSqlValidator.js";
+import InvalidSqlError from "@/domain/errors/InvalidSqlError.js";
+import { SQL_MAX_ROWS } from "@/config/constants.js";
+
+describe("RegexSqlValidator", () => {
+  const validator = new RegexSqlValidator();
+
+  describe("valid queries", () => {
+    it("accepts SELECT query and adds LIMIT", () => {
+      const result = validator.validate(`SELECT * FROM orders`);
+      expect(result).toBe(`SELECT * FROM orders LIMIT ${SQL_MAX_ROWS}`);
+    });
+
+    it("accepts SELECT with lowercase", () => {
+      const result = validator.validate(`select * from orders`);
+      expect(result).toBe(`select * from orders LIMIT ${SQL_MAX_ROWS}`);
+    });
+
+    it("accepts WITH query", () => {
+      const result = validator.validate(`WITH cte AS (SELECT 1) SELECT * FROM cte`);
+      expect(result).toBe(`WITH cte AS (SELECT 1) SELECT * FROM cte LIMIT ${SQL_MAX_ROWS}`);
+    });
+
+    it("accepts WITH with lowercase", () => {
+      const result = validator.validate(`with cte as (select 1) select * from cte`);
+      expect(result).toBe(`with cte as (select 1) select * from cte LIMIT ${SQL_MAX_ROWS}`);
+    });
+
+    it("does not duplicate LIMIT when present", () => {
+      const result = validator.validate(`SELECT * FROM orders LIMIT 10`);
+      expect(result).toBe(`SELECT * FROM orders LIMIT 10`);
+    });
+
+    it("accepts trailing semicolon", () => {
+      const result = validator.validate(`SELECT * FROM orders;`);
+      expect(result).toBe(`SELECT * FROM orders LIMIT ${SQL_MAX_ROWS}`);
+    });
+
+    it("accepts keyword in string literal", () => {
+      const result = validator.validate(
+        `SELECT * FROM orders WHERE name LIKE 'drop%'`,
+      );
+      expect(result).toBe(
+        `SELECT * FROM orders WHERE name LIKE 'drop%' LIMIT ${SQL_MAX_ROWS}`,
+      );
+    });
+
+    it("normalizes multiple whitespaces", () => {
+      const result = validator.validate(`SELECT   *   FROM    orders`);
+      expect(result).toBe(`SELECT * FROM orders LIMIT ${SQL_MAX_ROWS}`);
+    });
+
+    it("normalizes leading and trailing whitespace", () => {
+      const result = validator.validate(`  SELECT * FROM orders  `);
+      expect(result).toBe(`SELECT * FROM orders LIMIT ${SQL_MAX_ROWS}`);
+    });
+
+    it("normalizes spacing in LIMIT clause", () => {
+      const result = validator.validate(`SELECT * FROM orders LIMIT   50`);
+      expect(result).toBe(`SELECT * FROM orders LIMIT 50`);
+    });
+
+    it("handles complex WITH and SELECT", () => {
+      const sql = `WITH RECURSIVE nums AS (SELECT 1 AS n UNION ALL SELECT n + 1 FROM nums WHERE n < 100) SELECT * FROM nums`;
+      const result = validator.validate(sql);
+      expect(result).toContain(`LIMIT ${SQL_MAX_ROWS}`);
+    });
+  });
+
+  describe("invalid queries - mutation keywords", () => {
+    const mutationKeywords = [
+      `INSERT`,
+      `UPDATE`,
+      `DELETE`,
+      `DROP`,
+      `CREATE`,
+      `ALTER`,
+      `TRUNCATE`,
+      `GRANT`,
+      `REVOKE`,
+      `COPY`,
+      `CALL`,
+      `VACUUM`,
+      `MERGE`,
+    ];
+
+    mutationKeywords.forEach((keyword) => {
+      it(`rejects ${keyword} keyword`, () => {
+        const queries = [
+          `${keyword} INTO orders VALUES (1)`,
+          `${keyword} orders SET id = 1`,
+          `${keyword} TABLE orders`,
+          `SELECT * FROM orders; ${keyword} orders`,
+        ];
+
+        queries.forEach((query) => {
+          if (/^(INSERT|UPDATE|DELETE)/.test(query)) {
+            expect(() => validator.validate(query)).toThrow(InvalidSqlError);
+          } else {
+            expect(() => validator.validate(query)).toThrow(InvalidSqlError);
+          }
+        });
+      });
+    });
+  });
+
+  describe("invalid queries - structure", () => {
+    it("rejects empty string", () => {
+      expect(() => validator.validate(``)).toThrow(InvalidSqlError);
+    });
+
+    it("rejects whitespace only", () => {
+      expect(() => validator.validate(`   `)).toThrow(InvalidSqlError);
+    });
+
+    it("rejects query not starting with SELECT or WITH", () => {
+      expect(() => validator.validate(`EXPLAIN SELECT * FROM orders`)).toThrow(
+        InvalidSqlError,
+      );
+    });
+
+    it("rejects multiple statements with semicolon separator", () => {
+      expect(() =>
+        validator.validate(`SELECT * FROM orders; DROP TABLE orders`),
+      ).toThrow(InvalidSqlError);
+    });
+
+    it("rejects semicolon in middle of query", () => {
+      expect(() =>
+        validator.validate(
+          `SELECT * FROM orders WHERE id = 1; SELECT * FROM users`,
+        ),
+      ).toThrow(InvalidSqlError);
+    });
+
+    it("rejects query starting with numbers", () => {
+      expect(() => validator.validate(`123 SELECT * FROM orders`)).toThrow(
+        InvalidSqlError,
+      );
+    });
+
+    it("rejects query starting with comments", () => {
+      expect(() => validator.validate(`-- comment\nSELECT *`)).toThrow(
+        InvalidSqlError,
+      );
+    });
+  });
+
+  describe("error messages", () => {
+    it("provides meaningful error for empty query", () => {
+      try {
+        validator.validate(``);
+        expect.fail(`Should throw`);
+      } catch (error) {
+        expect(error).toBeInstanceOf(InvalidSqlError);
+        expect((error as InvalidSqlError).reason).toBe(`Query cannot be empty`);
+      }
+    });
+
+    it("provides meaningful error for missing SELECT/WITH", () => {
+      try {
+        validator.validate(`EXPLAIN SELECT * FROM orders`);
+        expect.fail(`Should throw`);
+      } catch (error) {
+        expect(error).toBeInstanceOf(InvalidSqlError);
+        expect((error as InvalidSqlError).reason).toContain(
+          `must start with SELECT or WITH`,
+        );
+      }
+    });
+
+    it("rejects queries starting with mutation keywords", () => {
+      try {
+        validator.validate(`INSERT INTO orders VALUES (1)`);
+        expect.fail(`Should throw`);
+      } catch (error) {
+        expect(error).toBeInstanceOf(InvalidSqlError);
+        expect((error as InvalidSqlError).reason).toContain(
+          `must start with SELECT or WITH`,
+        );
+      }
+    });
+
+
+    it("provides meaningful error for multiple statements", () => {
+      try {
+        validator.validate(`SELECT * FROM a; SELECT * FROM b`);
+        expect.fail(`Should throw`);
+      } catch (error) {
+        expect(error).toBeInstanceOf(InvalidSqlError);
+        expect((error as InvalidSqlError).reason).toContain(
+          `Multiple statements are forbidden`,
+        );
+      }
+    });
+
+    it("stores original SQL in error", () => {
+      const originalSql = `INVALID SQL HERE`;
+      try {
+        validator.validate(originalSql);
+        expect.fail(`Should throw`);
+      } catch (error) {
+        expect(error).toBeInstanceOf(InvalidSqlError);
+        expect((error as InvalidSqlError).sql).toBe(originalSql);
+      }
+    });
+  });
+
+  describe("edge cases", () => {
+    it("accepts SELECT inside string literal with keyword", () => {
+      const result = validator.validate(
+        `SELECT * FROM orders WHERE description = 'INSERT INTO backup'`,
+      );
+      expect(result).toContain(`LIMIT ${SQL_MAX_ROWS}`);
+    });
+
+    it("handles mixed case keywords", () => {
+      expect(() =>
+        validator.validate(`SeLeCt * FrOm orders; DrOp TaBlE orders`),
+      ).toThrow(InvalidSqlError);
+    });
+
+    it("accepts word boundary for keywords", () => {
+      const result = validator.validate(
+        `SELECT * FROM insert_logs WHERE inserted_at > NOW()`,
+      );
+      expect(result).toContain(`LIMIT ${SQL_MAX_ROWS}`);
+    });
+
+    it("preserves tabs and newlines as single space", () => {
+      const result = validator.validate(`SELECT\n*\tFROM\norders`);
+      expect(result).toBe(`SELECT * FROM orders LIMIT ${SQL_MAX_ROWS}`);
+    });
+
+    it("handles very long query", () => {
+      const longQuery = `SELECT ${`col1, col2, col3, `.repeat(100)} col_final FROM orders`;
+      const result = validator.validate(longQuery);
+      expect(result).toContain(`LIMIT ${SQL_MAX_ROWS}`);
+    });
+  });
+});

package/src/infrastructure/sql/RegexSqlValidator.ts

@@ -0,0 +1,53 @@
+import SqlValidator from "@/domain/ports/SqlValidator.js";
+import InvalidSqlError from "@/domain/errors/InvalidSqlError.js";
+import { SQL_MAX_ROWS } from "@/config/constants.js";
+
+class RegexSqlValidator implements SqlValidator {
+  private readonly mutationKeywords =
+    /\b(INSERT|UPDATE|DELETE|DROP|CREATE|ALTER|TRUNCATE|GRANT|REVOKE|COPY|CALL|VACUUM|MERGE)\b/i;
+
+  private stripStringLiterals(sql: string): string {
+    return sql.replace(/'(?:''|[^'])*'/g, `''`);
+  }
+
+  validate(raw: string): string {
+    const trimmed = raw.trim().replace(/\s+/g, ` `);
+
+    if (!trimmed) {
+      throw new InvalidSqlError(raw, `Query cannot be empty`);
+    }
+
+    if (!/^(SELECT|WITH)\b/i.test(trimmed)) {
+      throw new InvalidSqlError(
+        raw,
+        `Query must start with SELECT or WITH`,
+      );
+    }
+
+    const sqlWithoutStrings = this.stripStringLiterals(trimmed);
+
+    if (this.mutationKeywords.test(sqlWithoutStrings)) {
+      throw new InvalidSqlError(
+        raw,
+        `Mutation keywords are forbidden`,
+      );
+    }
+
+    const withoutTrailingSemicolon = trimmed.replace(/;$/, ``);
+
+    if (withoutTrailingSemicolon.includes(`;`)) {
+      throw new InvalidSqlError(
+        raw,
+        `Multiple statements are forbidden`,
+      );
+    }
+
+    if (!/\bLIMIT\s+\d+/i.test(trimmed)) {
+      return `${withoutTrailingSemicolon} LIMIT ${SQL_MAX_ROWS}`;
+    }
+
+    return withoutTrailingSemicolon;
+  }
+}
+
+export default RegexSqlValidator;

package/src/infrastructure/sql/index.ts

@@ -0,0 +1 @@
+export { default as RegexSqlValidator } from "./RegexSqlValidator.js";

package/src/main.ts

@@ -0,0 +1,19 @@
+import { createContainer } from '@/config/Container.js';
+import { env } from '@/config/env.js';
+import registerAppMentionHandler from '@/infrastructure/slack/handlers/AppMentionHandler.js';
+import registerDirectMessageHandler from '@/infrastructure/slack/handlers/DirectMessageHandler.js';
+
+async function main() {
+  const { app, answerQuestion, logger } = createContainer();
+
+  registerAppMentionHandler(app, answerQuestion, logger);
+  registerDirectMessageHandler(app, answerQuestion, logger);
+
+  await app.start(env.PORT);
+  logger.info(`Bot started on port ${env.PORT.toString()}`);
+}
+
+main().catch((err: unknown) => {
+  console.error(`Fatal error at startup:`, err);
+  process.exit(1);
+});

package/tsconfig.json

@@ -0,0 +1,23 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "strict": true,
+    "noUncheckedIndexedAccess": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "resolveJsonModule": true,
+    "declaration": true,
+    "declarationMap": true,
+    "sourceMap": true,
+    "paths": {
+      "@/*": ["./src/*"]
+    },
+    "outDir": "dist",
+    "rootDir": "src"
+  },
+  "include": ["src"],
+  "exclude": ["node_modules", "dist"]
+}

package/vitest.config.ts

@@ -0,0 +1,15 @@
+import { defineConfig } from 'vitest/config';
+import path from 'path';
+
+export default defineConfig({
+  test: {
+    globals: true,
+    passWithNoTests: true,
+    setupFiles: ['./vitest.setup.ts'],
+  },
+  resolve: {
+    alias: {
+      '@': path.resolve(__dirname, './src'),
+    },
+  },
+});

package/vitest.setup.ts

@@ -0,0 +1,23 @@
+import { readFileSync } from "fs";
+import { fileURLToPath } from "url";
+import { dirname, join } from "path";
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+const envPath = join(__dirname, ".env.test");
+
+try {
+  const envContent = readFileSync(envPath, "utf-8");
+  const lines = envContent.split("\n");
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const [key, ...valueParts] = trimmed.split("=");
+    const value = valueParts.join("=");
+    if (key && !process.env[key]) {
+      process.env[key] = value;
+    }
+  }
+} catch {
+  console.warn("Could not load .env.test file");
+}