fhirsmith 0.18.2 → 1.0.0

package/xig/xig.js

@@ -16,6 +16,7 @@ const zlib = require('zlib');
 const htmlServer = require('../library/html-server');
 const folders = require('../library/folder-setup');
 const escape = require('escape-html');
+const { guarded } = require('../library/sqlite-utilities');
 
 const Logger = require('../library/logger');
 const {describeCron} = require("../library/cron-utilities");
@@ -55,6 +56,9 @@ let cacheLoadInProgress = false;
 
 // Update history - tracks every download attempt for diagnostics
 const MAX_UPDATE_HISTORY = 20;
+// The daily download runs at 02:00 local time
+const UPDATE_CRON = '0 2 * * *';
+const UPDATE_HOUR = 2;
 let updateHistory = [];
 let updateInProgress = false;
 
@@ -99,124 +103,112 @@ function validateExternalUrl(url) {
   }
 }
 
-// Secure SQL query building with parameterized queries
-function buildSecureResourceQuery(queryParams, offset = 0, limit = 50) {
-  const { realm, auth, ver, type, rt, text, pkg, onlyUsed } = queryParams;
+// The columns that say which FHIR versions a resource is for (also the values of ver)
+const VERSION_COLUMNS = ['R2', 'R2B', 'R3', 'R4', 'R4B', 'R5', 'R6'];
 
-  let baseQuery = `
-      SELECT
-          ResourceKey, ResourceType, Type, Kind, Description, PackageKey,
-          Realm, Authority, R2, R2B, R3, R4, R4B, R5, R6,
-          Id, Url, Version, Status, Date, Name, Title, Content,
-          Supplements, Details, FMM, WG, StandardsStatus, Web,
-          (SELECT COUNT(*) FROM DependencyList WHERE TargetKey = Resources.ResourceKey) AS UsageCount
-      FROM Resources
-      WHERE 1=1
-  `;
+/**
+ * One request parameter as a string. Express makes a repeated parameter (?realm=a&realm=b) an
+ * array, and can make a bracketed one (?realm[x]=a) an object: the first value is used, and
+ * anything else is treated as not given.
+ */
+function queryValue(v) {
+  if (Array.isArray(v)) {
+    v = v[0];
+  }
+  return typeof v === 'string' ? v : '';
+}
+
+/**
+ * The WHERE clause for the resource list filters (realm, auth, ver, type, rt, text, pkg,
+ * onlyUsed), with a ? for every value that comes from the request, and those values in order.
+ * Nothing from the request is put in the SQL itself: only fixed SQL chosen by it (ver, type).
+ * The list, its count and the summary statistics all use this, so they always agree.
+ *
+ * @param {Object} queryParams
+ * @returns {{where: string, params: Array}} where starts with WHERE (WHERE 1=1 when nothing is filtered)
+ */
+function buildResourceFilter(queryParams) {
+  const realm = queryValue(queryParams.realm);
+  const auth = queryValue(queryParams.auth);
+  const ver = queryValue(queryParams.ver);
+  const type = queryValue(queryParams.type);
+  const rt = queryValue(queryParams.rt);
+  const text = queryValue(queryParams.text);
+  const pkg = queryValue(queryParams.pkg);
+  const onlyUsed = queryValue(queryParams.onlyUsed);
 
   const conditions = [];
   const params = [];
 
-  // Realm filter
-  if (realm && realm !== '') {
+  if (realm) {
     conditions.push('AND realm = ?');
     params.push(realm);
   }
 
-  // Authority filter
-  if (auth && auth !== '') {
+  if (auth) {
     conditions.push('AND authority = ?');
     params.push(auth);
   }
 
-  // Version filter
-  if (ver) {
-    switch (ver) {
-      case 'R2':
-        conditions.push('AND R2 = 1');
-        break;
-      case 'R2B':
-        conditions.push('AND R2B = 1');
-        break;
-      case 'R3':
-        conditions.push('AND R3 = 1');
-        break;
-      case 'R4':
-        conditions.push('AND R4 = 1');
-        break;
-      case 'R4B':
-        conditions.push('AND R4B = 1');
-        break;
-      case 'R5':
-        conditions.push('AND R5 = 1');
-        break;
-      case 'R6':
-        conditions.push('AND R6 = 1');
-        break;
-    }
+  // a column name, so only one of the known ones
+  if (VERSION_COLUMNS.includes(ver)) {
+    conditions.push(`AND ${ver} = 1`);
   }
 
-  // Type-specific filters
   switch (type) {
     case 'cs': // CodeSystem
       conditions.push("AND ResourceType = 'CodeSystem'");
       break;
-
     case 'rp': // Resource Profiles
       conditions.push("AND ResourceType = 'StructureDefinition' AND kind = 'resource'");
-      if (rt && rt !== '' && hasCachedValue('profileResources', rt)) {
+      if (rt && hasCachedValue('profileResources', rt)) {
         conditions.push('AND Type = ?');
         params.push(rt);
       }
       break;
-
     case 'dp': // Datatype Profiles
       conditions.push("AND ResourceType = 'StructureDefinition' AND (kind = 'complex-type' OR kind = 'primitive-type')");
-      if (rt && rt !== '' && hasCachedValue('profileTypes', rt)) {
+      if (rt && hasCachedValue('profileTypes', rt)) {
         conditions.push('AND Type = ?');
         params.push(rt);
       }
       break;
-
     case 'lm': // Logical Models
       conditions.push("AND ResourceType = 'StructureDefinition' AND kind = 'logical'");
       break;
-
     case 'ext': // Extensions
       conditions.push("AND ResourceType = 'StructureDefinition' AND Type = 'Extension'");
-      if (rt && rt !== '' && hasCachedValue('extensionContexts', rt)) {
+      if (rt && hasCachedValue('extensionContexts', rt)) {
         conditions.push('AND ResourceKey IN (SELECT ResourceKey FROM Categories WHERE Mode = 2 AND Code = ?)');
         params.push(rt);
       }
       break;
-
     case 'vs': // ValueSets
       conditions.push("AND ResourceType = 'ValueSet'");
-      if (rt && rt !== '' && hasTerminologySource(rt)) {
+      if (rt && hasTerminologySource(rt)) {
         conditions.push('AND ResourceKey IN (SELECT ResourceKey FROM Categories WHERE Mode = 1 AND Code = ?)');
         params.push(rt);
       }
       break;
-
     case 'cm': // ConceptMaps
       conditions.push("AND ResourceType = 'ConceptMap'");
-      if (rt && rt !== '' && hasTerminologySource(rt)) {
+      if (rt && hasTerminologySource(rt)) {
         conditions.push('AND ResourceKey IN (SELECT ResourceKey FROM Categories WHERE Mode = 1 AND Code = ?)');
         params.push(rt);
       }
       break;
-
     default:
       // No specific type selected
-      if (rt && rt !== '' && hasCachedValue('resourceTypes', rt)) {
+      if (rt && hasCachedValue('resourceTypes', rt)) {
         conditions.push('AND ResourceType = ?');
         params.push(rt);
       }
       break;
   }
 
-  // Text search filter
-  if (text && text !== '') {
+  // Text search: one FTS phrase, so the text is searched for as written (a " in it is doubled,
+  // which is how a phrase holds one, so it can't end the phrase and add query syntax)
+  if (text) {
     const ftsText = text.replace(/"/g, '""');
     if (type === 'cs') {
       conditions.push(`AND (ResourceKey IN (SELECT ResourceKey FROM ResourceFTS WHERE ResourceFTS MATCH ?)
@@ -228,129 +220,37 @@ function buildSecureResourceQuery(queryParams, offset = 0, limit = 50) {
     }
   }
 
-  // Package filter - matches packageId#version containing the search string
-  if (pkg && pkg !== '') {
-    conditions.push('AND PackageKey IN (SELECT PackageKey FROM Packages WHERE (Id || \'#\' || Version) LIKE ?)');
-    params.push(`%${pkg}%`);
+  // Package filter - packageId#version containing the text, as written (% and _ are not wildcards)
+  if (pkg) {
+    conditions.push("AND PackageKey IN (SELECT PackageKey FROM Packages WHERE (Id || '#' || Version) LIKE ? ESCAPE '\\')");
+    params.push(`%${pkg.replace(/[\\%_]/g, c => '\\' + c)}%`);
   }
 
-  // Only used filter
   if (onlyUsed === 'true') {
     conditions.push('AND EXISTS (SELECT 1 FROM DependencyList WHERE TargetKey = Resources.ResourceKey)');
   }
 
-  // Build final query
-  const fullQuery = baseQuery + ' ' + conditions.join(' ') + ' ORDER BY ResourceType, Type, Description LIMIT ? OFFSET ?';
-  params.push(limit, offset);
+  return { where: ['WHERE 1=1', ...conditions].join(' '), params };
+}
 
-  return { query: fullQuery, params };
+function buildSecureResourceQuery(queryParams, offset = 0, limit = 50) {
+  const { where, params } = buildResourceFilter(queryParams);
+  const query = `
+      SELECT
+          ResourceKey, ResourceType, Type, Kind, Description, PackageKey,
+          Realm, Authority, R2, R2B, R3, R4, R4B, R5, R6,
+          Id, Url, Version, Status, Date, Name, Title, Content,
+          Supplements, Details, FMM, WG, StandardsStatus, Web,
+          (SELECT COUNT(*) FROM DependencyList WHERE TargetKey = Resources.ResourceKey) AS UsageCount
+      FROM Resources
+      ${where}
+      ORDER BY ResourceType, Type, Description LIMIT ? OFFSET ?`;
+  return { query, params: [...params, limit, offset] };
 }
 
 function buildSecureResourceCountQuery(queryParams) {
-  const { realm, auth, ver, type, rt, text, pkg, onlyUsed } = queryParams;
-
-  let baseQuery = 'SELECT COUNT(*) as total FROM Resources WHERE 1=1';
-  const conditions = [];
-  const params = [];
-
-  // Same conditions as main query but for counting
-  if (realm && realm !== '') {
-    conditions.push('AND realm = ?');
-    params.push(realm);
-  }
-
-  if (auth && auth !== '') {
-    conditions.push('AND authority = ?');
-    params.push(auth);
-  }
-
-  if (ver) {
-    switch (ver) {
-      case 'R2': conditions.push('AND R2 = 1'); break;
-      case 'R2B': conditions.push('AND R2B = 1'); break;
-      case 'R3': conditions.push('AND R3 = 1'); break;
-      case 'R4': conditions.push('AND R4 = 1'); break;
-      case 'R4B': conditions.push('AND R4B = 1'); break;
-      case 'R5': conditions.push('AND R5 = 1'); break;
-      case 'R6': conditions.push('AND R6 = 1'); break;
-    }
-  }
-
-  switch (type) {
-    case 'cs':
-      conditions.push("AND ResourceType = 'CodeSystem'");
-      break;
-    case 'rp':
-      conditions.push("AND ResourceType = 'StructureDefinition' AND kind = 'resource'");
-      if (rt && rt !== '' && hasCachedValue('profileResources', rt)) {
-        conditions.push('AND Type = ?');
-        params.push(rt);
-      }
-      break;
-    case 'dp':
-      conditions.push("AND ResourceType = 'StructureDefinition' AND (kind = 'complex-type' OR kind = 'primitive-type')");
-      if (rt && rt !== '' && hasCachedValue('profileTypes', rt)) {
-        conditions.push('AND Type = ?');
-        params.push(rt);
-      }
-      break;
-    case 'lm':
-      conditions.push("AND ResourceType = 'StructureDefinition' AND kind = 'logical'");
-      break;
-    case 'ext':
-      conditions.push("AND ResourceType = 'StructureDefinition' AND Type = 'Extension'");
-      if (rt && rt !== '' && hasCachedValue('extensionContexts', rt)) {
-        conditions.push('AND ResourceKey IN (SELECT ResourceKey FROM Categories WHERE Mode = 2 AND Code = ?)');
-        params.push(rt);
-      }
-      break;
-    case 'vs':
-      conditions.push("AND ResourceType = 'ValueSet'");
-      if (rt && rt !== '' && hasTerminologySource(rt)) {
-        conditions.push('AND ResourceKey IN (SELECT ResourceKey FROM Categories WHERE Mode = 1 AND Code = ?)');
-        params.push(rt);
-      }
-      break;
-    case 'cm':
-      conditions.push("AND ResourceType = 'ConceptMap'");
-      if (rt && rt !== '' && hasTerminologySource(rt)) {
-        conditions.push('AND ResourceKey IN (SELECT ResourceKey FROM Categories WHERE Mode = 1 AND Code = ?)');
-        params.push(rt);
-      }
-      break;
-    default:
-      if (rt && rt !== '' && hasCachedValue('resourceTypes', rt)) {
-        conditions.push('AND ResourceType = ?');
-        params.push(rt);
-      }
-      break;
-  }
-
-  if (text && text !== '') {
-    const ftsText = text.replace(/"/g, '""');
-    if (type === 'cs') {
-      conditions.push(`AND (ResourceKey IN (SELECT ResourceKey FROM ResourceFTS WHERE ResourceFTS MATCH ?)
-                    OR ResourceKey IN (SELECT ResourceKey FROM CodeSystemFTS WHERE CodeSystemFTS MATCH ?))`);
-      params.push(`{Description Narrative} : "${ftsText}"`, `{Display Definition} : "${ftsText}"`);
-    } else {
-      conditions.push('AND ResourceKey IN (SELECT ResourceKey FROM ResourceFTS WHERE ResourceFTS MATCH ?)');
-      params.push(`{Description Narrative} : "${ftsText}"`);
-    }
-  }
-
-  // Package filter - matches packageId#version containing the search string
-  if (pkg && pkg !== '') {
-    conditions.push('AND PackageKey IN (SELECT PackageKey FROM Packages WHERE (Id || \'#\' || Version) LIKE ?)');
-    params.push(`%${pkg}%`);
-  }
-
-  // Only used filter
-  if (onlyUsed === 'true') {
-    conditions.push('AND EXISTS (SELECT 1 FROM DependencyList WHERE TargetKey = Resources.ResourceKey)');
-  }
-
-  const fullQuery = baseQuery + ' ' + conditions.join(' ');
-  return { query: fullQuery, params };
+  const { where, params } = buildResourceFilter(queryParams);
+  return { query: `SELECT COUNT(*) as total FROM Resources ${where}`, params };
 }
 
 // Template Functions
@@ -463,141 +363,6 @@ function buildContentHtml(contentData) {
   return html;
 }
 
-// SQL Filter Building Functions
-
-function sqlEscapeString(str) {
-  if (!str) return '';
-  // Escape single quotes for SQL
-  return str.replace(/'/g, "''");
-}
-
-function buildSqlFilter(queryParams) {
-  const { realm, auth, ver, type, rt, text, pkg, onlyUsed } = queryParams;
-  let filter = '';
-
-  // Realm filter
-  if (realm && realm !== '') {
-    filter += ` and realm = '${sqlEscapeString(realm)}'`;
-  }
-
-  // Authority filter
-  if (auth && auth !== '') {
-    filter += ` and authority = '${sqlEscapeString(auth)}'`;
-  }
-
-  // Version filter - check specific version columns
-  if (ver) {
-    switch (ver) {
-      case 'R2':
-        filter += ' and R2 = 1';
-        break;
-      case 'R2B':
-        filter += ' and R2B = 1';
-        break;
-      case 'R3':
-        filter += ' and R3 = 1';
-        break;
-      case 'R4':
-        filter += ' and R4 = 1';
-        break;
-      case 'R4B':
-        filter += ' and R4B = 1';
-        break;
-      case 'R5':
-        filter += ' and R5 = 1';
-        break;
-      case 'R6':
-        filter += ' and R6 = 1';
-        break;
-    }
-  }
-
-  // Type-specific filters
-  switch (type) {
-    case 'cs': // CodeSystem
-      filter += " and ResourceType = 'CodeSystem'";
-      break;
-
-    case 'rp': // Resource Profiles
-      filter += " and ResourceType = 'StructureDefinition' and kind = 'resource'";
-      if (rt && rt !== '' && hasCachedValue('profileResources', rt)) {
-        filter += ` and Type = '${sqlEscapeString(rt)}'`;
-      }
-      break;
-
-    case 'dp': // Datatype Profiles
-      filter += " and ResourceType = 'StructureDefinition' and (kind = 'complex-type' or kind = 'primitive-type')";
-      if (rt && rt !== '' && hasCachedValue('profileTypes', rt)) {
-        filter += ` and Type = '${sqlEscapeString(rt)}'`;
-      }
-      break;
-
-    case 'lm': // Logical Models
-      filter += " and ResourceType = 'StructureDefinition' and kind = 'logical'";
-      break;
-
-    case 'ext': // Extensions
-      filter += " and ResourceType = 'StructureDefinition' and (Type = 'Extension')";
-      if (rt && rt !== '' && hasCachedValue('extensionContexts', rt)) {
-        filter += ` and ResourceKey in (Select ResourceKey from Categories where Mode = 2 and Code = '${sqlEscapeString(rt)}')`;
-      }
-      break;
-
-    case 'vs': // ValueSets
-      filter += " and ResourceType = 'ValueSet'";
-      if (rt && rt !== '' && hasTerminologySource(rt)) {
-        filter += ` and ResourceKey in (Select ResourceKey from Categories where Mode = 1 and Code = '${sqlEscapeString(rt)}')`;
-      }
-      break;
-
-    case 'cm': // ConceptMaps
-      filter += " and ResourceType = 'ConceptMap'";
-      if (rt && rt !== '' && hasTerminologySource(rt)) {
-        filter += ` and ResourceKey in (Select ResourceKey from Categories where Mode = 1 and Code = '${sqlEscapeString(rt)}')`;
-      }
-      break;
-
-    default:
-      // No specific type selected - handle rt parameter for general resource filtering
-      if (rt && rt !== '' && hasCachedValue('resourceTypes', rt)) {
-        filter += ` and ResourceType = '${sqlEscapeString(rt)}'`;
-      }
-      break;
-  }
-
-  // Text search filter
-  if (text && text !== '') {
-    const escapedText = sqlEscapeString(text);
-    if (type === 'cs') {
-      // Special handling for CodeSystems - search both resource and CodeSystem-specific fields
-      filter += ` and (ResourceKey in (select ResourceKey from ResourceFTS where Description match '"${escapedText}"' or Narrative match '"${escapedText}"') ` +
-        `or ResourceKey in (select ResourceKey from CodeSystemFTS where Display match '"${escapedText}"' or Definition match '"${escapedText}"'))`;
-    } else {
-      // Standard resource text search
-      filter += ` and ResourceKey in (select ResourceKey from ResourceFTS where Description match '"${escapedText}"' or Narrative match '"${escapedText}"')`;
-    }
-  }
-
-  // Package filter - matches packageId#version containing the search string
-  if (pkg && pkg !== '') {
-    const escapedPkg = sqlEscapeString(pkg);
-    filter += ` and PackageKey in (select PackageKey from Packages where (Id || '#' || Version) like '%${escapedPkg}%')`;
-  }
-
-  // Only used filter
-  if (onlyUsed === 'true') {
-    filter += ` and exists (select 1 from DependencyList where TargetKey = Resources.ResourceKey)`;
-  }
-
-  // Convert to proper WHERE clause
-  if (filter !== '') {
-    // Remove the first " and " and prepend "WHERE "
-    filter = 'WHERE ' + filter.substring(4);
-  }
-
-  return filter;
-}
-
 // Helper function to check if a terminology source exists
 // This is a placeholder - you might need to implement this based on your data
 function hasTerminologySource(sourceCode) {
@@ -606,45 +371,6 @@ function hasTerminologySource(sourceCode) {
   return hasCachedValue('txSources', sourceCode);
 }
 
-function buildResourceListQuery(queryParams, offset = 0, limit = 50) {
-  const whereClause = buildSqlFilter(queryParams);
-
-  // Build the complete SQL query
-  let sql = `
-      SELECT
-          ResourceKey,
-          ResourceType,
-          Type,
-          Kind,
-          Description,
-          PackageKey,
-          Realm,
-          Authority,
-          R2, R2B, R3, R4, R4B, R5, R6,
-          Id,
-          Url,
-          Version,
-          Status,
-          Date,
-          Name,
-          Title,
-          Content,
-          Supplements,
-          Details,
-          FMM,
-          WG,
-          StandardsStatus,
-          Web,
-          (SELECT COUNT(*) FROM DependencyList WHERE TargetKey = Resources.ResourceKey) AS UsageCount
-      FROM Resources
-          ${whereClause}
-      ORDER BY ResourceType, Type, Description
-          LIMIT ${limit} OFFSET ${offset}
-  `;
-
-  return sql.trim();
-}
-
 // Resource List Table Functions
 
 function buildPaginationControls(count, offset, baseUrl, queryParams) {
@@ -823,10 +549,10 @@ async function buildResourceTable(queryParams, resourceCount, offset = 0) {
     parts.push('</tr>');
 
     const resourceRows = await new Promise((resolve, reject) => {
-      xigDb.all(resourceQuery, qp, (err, rows) => {
+      xigDb.all(resourceQuery, qp, guarded(reject, (err, rows) => {
         if (err) reject(err);
         else resolve(rows || []);
-      });
+      }));
     });
 
     // Determine resource type prefix for links
@@ -969,10 +695,10 @@ async function buildResourceTable(queryParams, resourceCount, offset = 0) {
 async function fetchResourceRows(queryParams, offset = 0, limit = 200) {
   const { query: resourceQuery, params: qp } = buildSecureResourceQuery(queryParams, offset, limit);
   return new Promise((resolve, reject) => {
-    xigDb.all(resourceQuery, qp, (err, rows) => {
+    xigDb.all(resourceQuery, qp, guarded(reject, (err, rows) => {
       if (err) reject(err);
       else resolve(rows || []);
-    });
+    }));
   });
 }
 
@@ -1093,7 +819,7 @@ async function buildResourceCsv(queryParams) {
 
 async function buildSummaryStats(queryParams, baseUrl) {
   const { ver, auth, realm } = queryParams;
-  const currentFilter = buildSqlFilter(queryParams);
+  const { where, params } = buildResourceFilter(queryParams);
   let html = '';
 
   if (!xigDb) {
@@ -1110,18 +836,16 @@ async function buildSummaryStats(queryParams, baseUrl) {
       const versions = getCachedSet('versions');
       for (const version of versions) {
         try {
-          let sql;
-          if (currentFilter === '') {
-            sql = `SELECT COUNT(*) as count FROM Resources WHERE ${version} = 1`;
-          } else {
-            sql = `SELECT COUNT(*) as count FROM Resources ${currentFilter} AND ${version} = 1`;
+          if (!VERSION_COLUMNS.includes(version)) {
+            continue; // a column name, so only one of the known ones
           }
+          const sql = `SELECT COUNT(*) as count FROM Resources ${where} AND ${version} = 1`;
 
           const count = await new Promise((resolve, reject) => {
-            xigDb.get(sql, [], (err, row) => {
+            xigDb.get(sql, params, guarded(reject, (err, row) => {
               if (err) reject(err);
               else resolve(row ? row.count : 0);
-            });
+            }));
           });
 
           const linkUrl = buildVersionLinkUrl(baseUrl, queryParams, version);
@@ -1138,18 +862,13 @@ async function buildSummaryStats(queryParams, baseUrl) {
       html += '<p><strong>By Authority</strong></p>';
       html += '<ul style="columns: 4; -webkit-columns: 4; -moz-columns: 4">';
 
-      let sql;
-      if (currentFilter === '') {
-        sql = 'SELECT Authority, COUNT(*) as count FROM Resources GROUP BY Authority ORDER BY Authority';
-      } else {
-        sql = `SELECT Authority, COUNT(*) as count FROM Resources ${currentFilter} GROUP BY Authority ORDER BY Authority`;
-      }
+      const sql = `SELECT Authority, COUNT(*) as count FROM Resources ${where} GROUP BY Authority ORDER BY Authority`;
 
       const authorityResults = await new Promise((resolve, reject) => {
-        xigDb.all(sql, [], (err, rows) => {
+        xigDb.all(sql, params, guarded(reject, (err, rows) => {
           if (err) reject(err);
           else resolve(rows || []);
-        });
+        }));
       });
 
       authorityResults.forEach(row => {
@@ -1171,18 +890,13 @@ async function buildSummaryStats(queryParams, baseUrl) {
       html += '<p><strong>By Realm</strong></p>';
       html += '<ul style="columns: 4; -webkit-columns: 4; -moz-columns: 4">';
 
-      let sql;
-      if (currentFilter === '') {
-        sql = 'SELECT Realm, COUNT(*) as count FROM Resources GROUP BY Realm ORDER BY Realm';
-      } else {
-        sql = `SELECT Realm, COUNT(*) as count FROM Resources ${currentFilter} GROUP BY Realm ORDER BY Realm`;
-      }
+      const sql = `SELECT Realm, COUNT(*) as count FROM Resources ${where} GROUP BY Realm ORDER BY Realm`;
 
       const realmResults = await new Promise((resolve, reject) => {
-        xigDb.all(sql, [], (err, rows) => {
+        xigDb.all(sql, params, guarded(reject, (err, rows) => {
           if (err) reject(err);
           else resolve(rows || []);
-        });
+        }));
       });
 
       var c = 0;
@@ -1825,7 +1539,7 @@ function validateDatabaseFile(filePath) {
       }
 
       // Try a simple query to ensure the database is accessible
-      testDb.get("SELECT name FROM sqlite_master WHERE type='table' LIMIT 1", (err) => {
+      testDb.get("SELECT name FROM sqlite_master WHERE type='table' LIMIT 1", guarded(reject, (err) => {
         testDb.close();
 
         if (err) {
@@ -1833,7 +1547,7 @@ function validateDatabaseFile(filePath) {
         } else {
           resolve();
         }
-      });
+      }));
     });
   });
 }
@@ -1861,13 +1575,13 @@ async function loadConfigCache() {
     // Helper function for simple queries
     const executeQuery = (sql, params = []) => {
       return new Promise((resolve, reject) => {
-        xigDb.all(sql, params, (err, rows) => {
+        xigDb.all(sql, params, guarded(reject, (err, rows) => {
           if (err) {
             reject(err);
           } else {
             resolve(rows);
           }
-        });
+        }));
       });
     };
 
@@ -2031,7 +1745,11 @@ function initializeDatabase() {
   });
 }
 
-async function updateXigDatabase() {
+/**
+ * Download the database afresh and swap it in.
+ * @param trigger - 'cron' (the daily schedule), 'startup' (no database yet) or 'manual'
+ */
+async function updateXigDatabase(trigger = 'manual') {
   if (updateInProgress) {
     xigLog.warn('Update already in progress, skipping');
     return;
@@ -2040,7 +1758,7 @@ async function updateXigDatabase() {
   updateInProgress = true;
   const entry = {
     timestamp: new Date(),
-    trigger: new Error().stack.includes('cron') ? 'cron' : 'manual',
+    trigger: trigger,
     status: 'started',
     sourceUrl: XIG_DB_URL,
     error: null,
@@ -2067,14 +1785,14 @@ async function updateXigDatabase() {
     entry.status = 'validated';
 
     if (xigDb) {
-      await new Promise((resolve) => {
-        xigDb.close((err) => {
+      await new Promise((resolve, reject) => {
+        xigDb.close(guarded(reject, (err) => {
           if (err) {
             xigLog.warn(`Warning: Error closing existing database: ${err.message}`);
           }
           xigDb = null;
           resolve();
-        });
+        }));
       });
     }
 
@@ -2135,7 +1853,7 @@ router.use(trackRequest);
 
 // Statistics functions
 function getDatabaseTableCounts() {
-  return new Promise((resolve) => {
+  return new Promise((resolve, reject) => {
     if (!xigDb) {
       resolve({ packages: 0, resources: 0 });
       return;
@@ -2145,7 +1863,7 @@ function getDatabaseTableCounts() {
     let completedQueries = 0;
     const totalQueries = 2;
 
-    xigDb.get('SELECT COUNT(*) as count FROM Packages', [], (err, row) => {
+    xigDb.get('SELECT COUNT(*) as count FROM Packages', [], guarded(reject, (err, row) => {
       if (err) {
         counts.packages = 0;
       } else {
@@ -2156,9 +1874,9 @@ function getDatabaseTableCounts() {
       if (completedQueries === totalQueries) {
         resolve(counts);
       }
-    });
+    }));
 
-    xigDb.get('SELECT COUNT(*) as count FROM Resources', [], (err, row) => {
+    xigDb.get('SELECT COUNT(*) as count FROM Resources', [], guarded(reject, (err, row) => {
       if (err) {
         counts.resources = 0;
       } else {
@@ -2169,7 +1887,7 @@ function getDatabaseTableCounts() {
       if (completedQueries === totalQueries) {
         resolve(counts);
       }
-    });
+    }));
   });
 }
 
@@ -2391,7 +2109,7 @@ function getDatabaseInfo() {
       return;
     }
 
-    xigDb.get("SELECT COUNT(*) as tableCount FROM sqlite_master WHERE type='table'", (err, row) => {
+    xigDb.get("SELECT COUNT(*) as tableCount FROM sqlite_master WHERE type='table'", guarded(reject, (err, row) => {
       if (err) {
         reject(err);
       } else {
@@ -2402,7 +2120,7 @@ function getDatabaseInfo() {
           fileSize: fs.existsSync(XIG_DB_PATH) ? fs.statSync(XIG_DB_PATH).size : 0
         });
       }
-    });
+    }));
   });
 }
 
@@ -2507,13 +2225,13 @@ router.get('/', async (req, res) => {
         if (xigDb) {
           const {query: countQuery, params: countParams} = buildSecureResourceCountQuery(queryParams);
           resourceCount = await new Promise((resolve, reject) => {
-            xigDb.get(countQuery, countParams, (err, row) => {
+            xigDb.get(countQuery, countParams, guarded(reject, (err, row) => {
               if (err) {
                 reject(err);
               } else {
                 resolve(row ? row.total : 0);
               }
-            });
+            }));
           });
         }
       } catch (error) {
@@ -2680,10 +2398,10 @@ router.get('/resource/:packagePid/:resourceType/:resourceId', async (req, res) =
       `;
 
       const resourceData = await new Promise((resolve, reject) => {
-        xigDb.get(resourceQuery, [packageObj.PackageKey, resourceType, resourceId], (err, row) => {
+        xigDb.get(resourceQuery, [packageObj.PackageKey, resourceType, resourceId], guarded(reject, (err, row) => {
           if (err) reject(err);
           else resolve(row);
-        });
+        }));
       });
 
       if (!resourceData) {
@@ -2830,10 +2548,10 @@ async function buildResourceDependencies(resourceData, secure = false) {
     `;
 
     const dependencies = await new Promise((resolve, reject) => {
-      xigDb.all(dependenciesQuery, [resourceData.ResourceKey], (err, rows) => {
+      xigDb.all(dependenciesQuery, [resourceData.ResourceKey], guarded(reject, (err, rows) => {
         if (err) reject(err);
         else resolve(rows || []);
-      });
+      }));
     });
 
     if (dependencies.length === 0) {
@@ -2855,10 +2573,10 @@ async function buildResourceDependencies(resourceData, secure = false) {
     `;
 
     const uses = await new Promise((resolve, reject) => {
-      xigDb.all(usesQuery, [resourceData.ResourceKey], (err, rows) => {
+      xigDb.all(usesQuery, [resourceData.ResourceKey], guarded(reject, (err, rows) => {
         if (err) reject(err);
         else resolve(rows || []);
-      });
+      }));
     });
 
     if (uses.length === 0) {
@@ -2895,10 +2613,10 @@ async function buildExtensionExamplesSection(resourceUrl) {
     `;
 
     const extensionExamples = await new Promise((resolve, reject) => {
-      xigDb.all(extensionExamplesQuery, [resourceUrl], (err, rows) => {
+      xigDb.all(extensionExamplesQuery, [resourceUrl], guarded(reject, (err, rows) => {
         if (err) reject(err);
         else resolve(rows || []);
-      });
+      }));
     });
 
     if (extensionExamples.length === 0) {
@@ -2998,10 +2716,10 @@ async function buildResourceNarrative(resourceKey, packageObj) {
     const contentsQuery = 'SELECT Json FROM Contents WHERE ResourceKey = ?';
 
     const blobData = await new Promise((resolve, reject) => {
-      xigDb.get(contentsQuery, [resourceKey], (err, row) => {
+      xigDb.get(contentsQuery, [resourceKey], guarded(reject, (err, row) => {
         if (err) reject(err);
         else resolve(row);
-      });
+      }));
     });
 
     if (!blobData || !blobData.Json) {
@@ -3060,10 +2778,10 @@ async function buildResourceSource(resourceKey) {
     const contentsQuery = 'SELECT Json FROM Contents WHERE ResourceKey = ?';
 
     const blobData = await new Promise((resolve, reject) => {
-      xigDb.get(contentsQuery, [resourceKey], (err, row) => {
+      xigDb.get(contentsQuery, [resourceKey], guarded(reject, (err, row) => {
         if (err) reject(err);
         else resolve(row);
-      });
+      }));
     });
 
     if (!blobData || !blobData.Json) {
@@ -3229,18 +2947,18 @@ async function initializeXigModule(stats, xigConfig) {
     if (!fs.existsSync(XIG_DB_PATH)) {
       xigLog.info('No existing XIG database found, triggering initial download');
       setTimeout(() => {
-        updateXigDatabase().catch((err) => xigLog.error('XIG database update failed: ' + err.message));
+        updateXigDatabase('startup').catch((err) => xigLog.error('XIG database update failed: ' + err.message));
       }, 5000);
     }
 
     if (globalStats) {
-      globalStats.addTask('XIG Download', describeCron('0 2 * * *'));
+      globalStats.addTask('XIG Download', describeCron(UPDATE_CRON));
     }
     // Check if auto-update is enabled
     // Note: This assumes we're called only when XIG is enabled
     if (xigConfig?.autoUpdate !== false) {
-      cron.schedule('0 2 * * *', () => {
-        updateXigDatabase().catch((err) => xigLog.error('XIG database update failed: ' + err.message));
+      cron.schedule(UPDATE_CRON, () => {
+        updateXigDatabase('cron').catch((err) => xigLog.error('XIG database update failed: ' + err.message));
       });
     }
 
@@ -3252,9 +2970,105 @@ async function initializeXigModule(stats, xigConfig) {
 
 // Graceful shutdown
 /**
- * The paragraph for the server's daily report: pages served, and whether the
- * database can be read (it's downloaded afresh each day, and a failed download
- * or an unreadable file is what this is for).
+ * The times (ms, local 02:00) the scheduled update was due in (since, now]
+ */
+function scheduledUpdatesBetween(since, now) {
+  const result = [];
+  const d = new Date(since);
+  d.setHours(UPDATE_HOUR, 0, 0, 0);
+  if (d.getTime() <= since) {
+    d.setDate(d.getDate() + 1);
+  }
+  while (d.getTime() <= now) {
+    result.push(d.getTime());
+    d.setDate(d.getDate() + 1);
+  }
+  return result;
+}
+
+/**
+ * The sentences about database updates in the period (since, now] for the daily report:
+ * affirms the scheduled update happened, or says that it failed or did not run.
+ *
+ * @param history - update attempts, newest first (getUpdateHistory())
+ * @param autoUpdate - false if scheduled updates are turned off
+ * @param dbModified - when the database file in use was written (ms), or null if there isn't one
+ */
+function describeUpdates(history, {since, now, autoUpdate = true, dbModified = null}) {
+  const {localDateTime, formatSpan, formatBytes} = require('../library/daily-report');
+  // just the time of day, unless it's more than a day before the report
+  const time = (t) => now - t <= 24 * 60 * 60 * 1000 ? localDateTime(t).substring(11) : localDateTime(t);
+  const at = (e) => (e.timestamp instanceof Date ? e.timestamp : new Date(e.timestamp)).getTime();
+  const detail = (e) => {
+    const bits = [];
+    if (e.downloadMeta && e.downloadMeta.downloadedBytes) {
+      bits.push(formatBytes(e.downloadMeta.downloadedBytes));
+    }
+    if (e.durationMs != null) {
+      bits.push(`took ${formatSpan(e.durationMs)}`);
+    }
+    return bits.length ? ` (${bits.join(', ')})` : '';
+  };
+
+  const sentences = [];
+  const attempts = (history || []).filter(e => at(e) > since && at(e) <= now).sort((a, b) => at(a) - at(b));
+  const scheduled = attempts.filter(e => e.trigger === 'cron');
+  const others = attempts.filter(e => e.trigger !== 'cron');
+  let updated = attempts.some(e => e.status === 'success');
+
+  if (autoUpdate === false) {
+    sentences.push('Scheduled database updates are turned off.');
+  } else {
+    const due = scheduledUpdatesBetween(since, now);
+    for (const e of scheduled) {
+      if (e.status === 'success') {
+        sentences.push(`The database was updated on schedule at ${time(at(e))}${detail(e)}.`);
+      } else if (e.status === 'failed') {
+        sentences.push(`The scheduled database update at ${time(at(e))} failed${e.error ? ': ' + e.error : ''}.`);
+      } else {
+        sentences.push(`The scheduled database update that started at ${time(at(e))} has not finished.`);
+      }
+    }
+    if (scheduled.length === 0 && due.length > 0) {
+      const last = due[due.length - 1];
+      if (dbModified != null && dbModified >= due[0] && dbModified <= now) {
+        // the record went with a restart, but the file shows it happened
+        sentences.push(`The database was updated at ${time(dbModified)}.`);
+        updated = true;
+      } else {
+        sentences.push(`The database was not updated on schedule: no update ran at ${time(last)} (was the server running then?).`);
+      }
+    }
+    if (scheduled.length > 0 && scheduled.length < due.length) {
+      sentences.push(`${due.length - scheduled.length} of the ${due.length} scheduled updates in this period did not run.`);
+    }
+    if (scheduled.length === 0 && due.length === 0 && attempts.length === 0) {
+      sentences.push('No database update was due in this period.');
+    }
+  }
+  for (const e of others) {
+    const how = e.trigger === 'startup' ? 'initial download' : 'manual update';
+    if (e.status === 'success') {
+      sentences.push(`A ${how} at ${time(at(e))} succeeded${detail(e)}.`);
+    } else if (e.status === 'failed') {
+      sentences.push(`A ${how} at ${time(at(e))} failed${e.error ? ': ' + e.error : ''}.`);
+    } else {
+      sentences.push(`A ${how} started at ${time(at(e))} has not finished.`);
+    }
+  }
+  if (!updated) {
+    if (dbModified == null) {
+      sentences.push('There is no database file.');
+    } else {
+      sentences.push(`The database in use was downloaded ${localDateTime(dbModified)} (${formatSpan(now - dbModified)} ago).`);
+    }
+  }
+  return sentences;
+}
+
+/**
+ * The paragraph for the server's daily report: pages served, whether the database
+ * was updated on schedule (it's downloaded afresh each day), and whether it can be read.
  */
 async function dailyReport({since, now}) {
   const {plural} = require('../library/daily-report');
@@ -3263,36 +3077,37 @@ async function dailyReport({since, now}) {
     const counts = globalStats.countsSince(since, now);
     sentences.push(`${plural(counts.total, 'page')} ${counts.total === 1 ? 'was' : 'were'} served.`);
   }
+  const age = getDatabaseAgeInfo();
+  sentences.push(...describeUpdates(getUpdateHistory(), {
+    since, now,
+    autoUpdate: xigSettings?.autoUpdate !== false,
+    dbModified: age.lastDownloaded ? age.lastDownloaded.getTime() : null
+  }));
   if (!xigDb) {
     sentences.push('The database is not open: it could not be accessed.');
   } else {
     try {
       const row = await new Promise((resolve, reject) =>
-        xigDb.get('SELECT COUNT(*) AS n FROM Resources', [], (err, row) => err ? reject(err) : resolve(row)));
+        xigDb.get('SELECT COUNT(*) AS n FROM Resources', [], guarded(reject, (err, row) => err ? reject(err) : resolve(row))));
       sentences.push(`The database holds ${plural(row.n, 'resource')}.`);
     } catch (e) {
       sentences.push(`The database could not be accessed: ${e.message}.`);
     }
   }
-  const last = getLastUpdateAttempt();
-  if (last && last.status === 'failed') {
-    const when = last.timestamp instanceof Date ? last.timestamp.toISOString().substring(0, 16).replace('T', ' ') : String(last.timestamp);
-    sentences.push(`The last database update (${when}) failed${last.error ? ': ' + last.error : ''}.`);
-  }
   return sentences.join(' ');
 }
 
 function shutdown() {
-  return new Promise((resolve) => {
+  return new Promise((resolve, reject) => {
     if (xigDb) {
-      xigDb.close((err) => {
+      xigDb.close(guarded(reject, (err) => {
         if (err) {
           xigLog.error(`Error closing XIG database: ${err.message}`);
         } else {
           xigLog.error('XIG database connection closed');
         }
         resolve();
-      });
+      }));
     } else {
       resolve();
     }
@@ -3363,10 +3178,9 @@ module.exports = {
   buildRealmLinkUrl,
 
   // SQL filter functions
-  buildSqlFilter,
-  buildResourceListQuery,
+  buildResourceFilter,
+  buildSecureResourceQuery,
   buildSecureResourceCountQuery,
-  sqlEscapeString,
   hasTerminologySource,
   gatherPageStatistics,
 
@@ -3377,6 +3191,8 @@ module.exports = {
   buildStatsTable,
   getUpdateHistory,
   getLastUpdateAttempt,
+  describeUpdates,
+  scheduledUpdatesBetween,
 
   // Event emitter
   cacheEmitter