graphile-postgis 2.9.2 → 2.9.3

package/esm/plugins/connection-filter-operators.js

@@ -2,21 +2,29 @@ import 'graphile-build';
 import 'graphile-connection-filter';
 import sql from 'pg-sql2';
 import { CONCRETE_SUBTYPES } from '../constants';
-const ALLOWED_SQL_OPERATORS = new Set([
-    '=',
-    '&&',
-    '&&&',
-    '&<',
-    '&<|',
-    '&>',
-    '|&>',
-    '<<',
-    '<<|',
-    '>>',
-    '|>>',
-    '~',
-    '~=',
-]);
+/**
+ * Builds an infix operator SQL fragment from a validated operator string.
+ * Uses explicit template literals for each operator to avoid sql.raw.
+ */
+function buildOperatorExpr(op, i, v) {
+    switch (op) {
+        case '=': return sql.fragment `${i} = ${v}`;
+        case '&&': return sql.fragment `${i} && ${v}`;
+        case '&&&': return sql.fragment `${i} &&& ${v}`;
+        case '&<': return sql.fragment `${i} &< ${v}`;
+        case '&<|': return sql.fragment `${i} &<| ${v}`;
+        case '&>': return sql.fragment `${i} &> ${v}`;
+        case '|&>': return sql.fragment `${i} |&> ${v}`;
+        case '<<': return sql.fragment `${i} << ${v}`;
+        case '<<|': return sql.fragment `${i} <<| ${v}`;
+        case '>>': return sql.fragment `${i} >> ${v}`;
+        case '|>>': return sql.fragment `${i} |>> ${v}`;
+        case '~': return sql.fragment `${i} ~ ${v}`;
+        case '~=': return sql.fragment `${i} ~= ${v}`;
+        default:
+            throw new Error(`Unexpected PostGIS SQL operator: ${op}`);
+    }
+}
 // PostGIS function-based operators
 const FUNCTION_SPECS = [
     [
@@ -233,15 +241,14 @@ export function createPostgisOperatorFactory() {
         }
         // Process SQL operator-based operators
         for (const [op, baseTypes, operatorName, description] of OPERATOR_SPECS) {
-            if (!ALLOWED_SQL_OPERATORS.has(op)) {
-                throw new Error(`Unexpected SQL operator: ${op}`);
-            }
             for (const baseType of baseTypes) {
+                // Capture op for closure
+                const capturedOp = op;
                 allSpecs.push({
                     typeNames: gqlTypeNamesByBase[baseType],
                     operatorName,
                     description,
-                    resolve: (i, v) => sql.fragment `${i} ${sql.raw(op)} ${v}`
+                    resolve: (i, v) => buildOperatorExpr(capturedOp, i, v)
                 });
             }
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "graphile-postgis",
-  "version": "2.9.2",
+  "version": "2.9.3",
   "description": "PostGIS support for PostGraphile v5",
   "author": "Constructive <developers@constructive.io>",
   "homepage": "https://github.com/constructive-io/constructive",
@@ -41,15 +41,15 @@
     "url": "https://github.com/constructive-io/constructive/issues"
   },
   "peerDependencies": {
-    "@dataplan/pg": "1.0.0-rc.8",
-    "grafast": "1.0.0-rc.9",
-    "graphile-build": "5.0.0-rc.6",
-    "graphile-build-pg": "5.0.0-rc.8",
-    "graphile-config": "1.0.0-rc.6",
-    "graphile-connection-filter": "^1.3.2",
+    "@dataplan/pg": "1.0.0",
+    "grafast": "1.0.0",
+    "graphile-build": "5.0.0",
+    "graphile-build-pg": "5.0.0",
+    "graphile-config": "1.0.0",
+    "graphile-connection-filter": "^1.3.3",
     "graphql": "16.13.0",
-    "pg-sql2": "5.0.0-rc.5",
-    "postgraphile": "5.0.0-rc.10"
+    "pg-sql2": "5.0.0",
+    "postgraphile": "5.0.0"
   },
   "peerDependenciesMeta": {
     "graphile-connection-filter": {
@@ -59,9 +59,9 @@
   "devDependencies": {
     "@types/geojson": "^7946.0.14",
     "@types/node": "^22.19.11",
-    "graphile-test": "^4.7.2",
-    "makage": "^0.1.10",
-    "pgsql-test": "^4.7.2"
+    "graphile-test": "^4.7.3",
+    "makage": "^0.3.0",
+    "pgsql-test": "^4.7.3"
   },
-  "gitHead": "93deca687ce109bf90d2a0a73ea6b05b22724160"
+  "gitHead": "baae875effd00af36577612c861d0f6f9a1a792a"
 }

package/plugins/connection-filter-operators.js

@@ -8,21 +8,29 @@ require("graphile-build");
 require("graphile-connection-filter");
 const pg_sql2_1 = __importDefault(require("pg-sql2"));
 const constants_1 = require("../constants");
-const ALLOWED_SQL_OPERATORS = new Set([
-    '=',
-    '&&',
-    '&&&',
-    '&<',
-    '&<|',
-    '&>',
-    '|&>',
-    '<<',
-    '<<|',
-    '>>',
-    '|>>',
-    '~',
-    '~=',
-]);
+/**
+ * Builds an infix operator SQL fragment from a validated operator string.
+ * Uses explicit template literals for each operator to avoid sql.raw.
+ */
+function buildOperatorExpr(op, i, v) {
+    switch (op) {
+        case '=': return pg_sql2_1.default.fragment `${i} = ${v}`;
+        case '&&': return pg_sql2_1.default.fragment `${i} && ${v}`;
+        case '&&&': return pg_sql2_1.default.fragment `${i} &&& ${v}`;
+        case '&<': return pg_sql2_1.default.fragment `${i} &< ${v}`;
+        case '&<|': return pg_sql2_1.default.fragment `${i} &<| ${v}`;
+        case '&>': return pg_sql2_1.default.fragment `${i} &> ${v}`;
+        case '|&>': return pg_sql2_1.default.fragment `${i} |&> ${v}`;
+        case '<<': return pg_sql2_1.default.fragment `${i} << ${v}`;
+        case '<<|': return pg_sql2_1.default.fragment `${i} <<| ${v}`;
+        case '>>': return pg_sql2_1.default.fragment `${i} >> ${v}`;
+        case '|>>': return pg_sql2_1.default.fragment `${i} |>> ${v}`;
+        case '~': return pg_sql2_1.default.fragment `${i} ~ ${v}`;
+        case '~=': return pg_sql2_1.default.fragment `${i} ~= ${v}`;
+        default:
+            throw new Error(`Unexpected PostGIS SQL operator: ${op}`);
+    }
+}
 // PostGIS function-based operators
 const FUNCTION_SPECS = [
     [
@@ -239,15 +247,14 @@ function createPostgisOperatorFactory() {
         }
         // Process SQL operator-based operators
         for (const [op, baseTypes, operatorName, description] of OPERATOR_SPECS) {
-            if (!ALLOWED_SQL_OPERATORS.has(op)) {
-                throw new Error(`Unexpected SQL operator: ${op}`);
-            }
             for (const baseType of baseTypes) {
+                // Capture op for closure
+                const capturedOp = op;
                 allSpecs.push({
                     typeNames: gqlTypeNamesByBase[baseType],
                     operatorName,
                     description,
-                    resolve: (i, v) => pg_sql2_1.default.fragment `${i} ${pg_sql2_1.default.raw(op)} ${v}`
+                    resolve: (i, v) => buildOperatorExpr(capturedOp, i, v)
                 });
             }
         }