graphile-bulk-mutations 0.2.0

package/utils/sql-builder.js

@@ -0,0 +1,126 @@
+"use strict";
+/**
+ * SQL builder utilities for bulk mutations.
+ *
+ * Provides parameterized SQL generation for VALUES clauses, ON CONFLICT
+ * clauses, and SET patches. Handles auto-batching when the parameter
+ * count would exceed PostgreSQL's 32K limit.
+ *
+ * IMPORTANT: All mutation queries use `RETURNING <pk_columns>` instead of
+ * `RETURNING *` to respect column-level SELECT grants. The caller is
+ * responsible for doing a follow-up SELECT using the returned PKs to
+ * resolve the full row through PostGraphile's grant-aware query pipeline.
+ * See: https://github.com/pyramation/graphile-column-privileges-mutations
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildBulkInsertSQL = buildBulkInsertSQL;
+exports.buildBulkUpdateSQL = buildBulkUpdateSQL;
+exports.buildBulkDeleteSQL = buildBulkDeleteSQL;
+const types_1 = require("../types");
+/**
+ * Builds parameterized INSERT ... VALUES SQL with optional ON CONFLICT clause.
+ * Auto-splits into multiple batches when parameter count exceeds PG_MAX_PARAMS.
+ *
+ * Uses `RETURNING <returningColumns>` (typically primary key columns) instead
+ * of `RETURNING *` to avoid permission errors with column-level SELECT grants.
+ */
+function buildBulkInsertSQL(tableName, columns, rows, returningColumns, onConflict) {
+    const colNames = columns.map((c) => `"${c.name}"`);
+    const colsPerRow = columns.length;
+    const maxRowsPerBatch = Math.floor(types_1.PG_MAX_PARAMS / colsPerRow);
+    const returningClause = returningColumns.length > 0
+        ? returningColumns.map((c) => `"${c}"`).join(', ')
+        : '*';
+    const batches = [];
+    for (let offset = 0; offset < rows.length; offset += maxRowsPerBatch) {
+        const batchRows = rows.slice(offset, offset + maxRowsPerBatch);
+        const values = [];
+        const valuePlaceholders = [];
+        for (const row of batchRows) {
+            const placeholders = [];
+            for (const col of columns) {
+                const val = row[col.name];
+                if (val === undefined) {
+                    placeholders.push('DEFAULT');
+                }
+                else if (val === null) {
+                    placeholders.push('NULL');
+                }
+                else {
+                    values.push(val);
+                    placeholders.push(`$${values.length}::${col.sqlType}`);
+                }
+            }
+            valuePlaceholders.push(`(${placeholders.join(', ')})`);
+        }
+        let text = `INSERT INTO ${tableName} (${colNames.join(', ')})\nVALUES ${valuePlaceholders.join(',\n       ')}`;
+        if (onConflict) {
+            if (onConflict.conflictColumns && onConflict.conflictColumns.length > 0) {
+                const colList = onConflict.conflictColumns.map((c) => `"${c}"`).join(', ');
+                text += `\nON CONFLICT (${colList})`;
+            }
+            else {
+                text += '\nON CONFLICT';
+            }
+            if (onConflict.action === 'IGNORE') {
+                text += ' DO NOTHING';
+            }
+            else if (onConflict.action === 'UPDATE') {
+                const setCols = onConflict.updateColumns && onConflict.updateColumns.length > 0
+                    ? onConflict.updateColumns
+                    : columns.map((c) => c.name);
+                const setClause = setCols
+                    .map((c) => `"${c}" = EXCLUDED."${c}"`)
+                    .join(', ');
+                text += ` DO UPDATE SET ${setClause}`;
+            }
+        }
+        text += `\nRETURNING ${returningClause}`;
+        batches.push({ text, values });
+    }
+    return batches;
+}
+/**
+ * Builds a parameterized UPDATE ... SET ... WHERE SQL statement.
+ *
+ * Uses `RETURNING <returningColumns>` (typically primary key columns) instead
+ * of `RETURNING *` to avoid permission errors with column-level SELECT grants.
+ */
+function buildBulkUpdateSQL(tableName, patch, columns, returningColumns, whereClause, whereParams) {
+    const values = [];
+    const setClauses = [];
+    for (const [fieldName, value] of Object.entries(patch)) {
+        const col = columns.find((c) => c.name === fieldName);
+        if (!col)
+            continue;
+        if (value === undefined)
+            continue;
+        values.push(value);
+        setClauses.push(`"${col.name}" = $${values.length}::${col.sqlType}`);
+    }
+    if (setClauses.length === 0) {
+        throw new Error('No columns to update in patch');
+    }
+    // Renumber where params to follow set params
+    const offset = values.length;
+    const renumberedWhere = whereClause.replace(/\$(\d+)/g, (_, n) => `$${parseInt(n) + offset}`);
+    values.push(...whereParams);
+    const returningClause = returningColumns.length > 0
+        ? returningColumns.map((c) => `"${c}"`).join(', ')
+        : '*';
+    const text = `UPDATE ${tableName}\nSET ${setClauses.join(', ')}\nWHERE ${renumberedWhere}\nRETURNING ${returningClause}`;
+    return { text, values };
+}
+/**
+ * Builds a parameterized DELETE ... WHERE SQL statement.
+ *
+ * Uses `RETURNING <returningColumns>` (typically primary key columns) instead
+ * of `RETURNING *` to avoid permission errors with column-level SELECT grants.
+ */
+function buildBulkDeleteSQL(tableName, returningColumns, whereClause, whereParams) {
+    const returningClause = returningColumns.length > 0
+        ? returningColumns.map((c) => `"${c}"`).join(', ')
+        : '*';
+    const text = `DELETE FROM ${tableName}\nWHERE ${whereClause}\nRETURNING ${returningClause}`;
+    return { text, values: [...whereParams] };
+}