ilana-orm 1.0.13 → 1.0.15

package/README.md

@@ -104,17 +104,23 @@ A fully-featured, Eloquent-style ORM for Node.js with automatic TypeScript suppo
 ## Installation
 
 ```bash
-# npm
 npm install ilana-orm
+```
 
-# yarn
-yarn add ilana-orm
+### Database Drivers
 
-# pnpm
-pnpm add ilana-orm
-```
+Install only the database driver you need:
 
-**All database drivers (PostgreSQL, MySQL, SQLite) and dotenv are included by default** - no additional installation required!
+```bash
+# PostgreSQL
+npm install pg
+
+# MySQL
+npm install mysql2
+
+# SQLite
+npm install sqlite3
+```
 
 ## Quick Start
 
@@ -4771,6 +4777,32 @@ class CustomCast {
 
 We welcome contributions! Please see our [Contributing Guide](CONTRIBUTING.md) for details.
 
+## Security
+
+### Reporting Vulnerabilities
+
+If you discover a security vulnerability, please email raphyabak@gmail.com with:
+- Description of the vulnerability
+- Steps to reproduce
+- Potential impact
+
+We will respond within 48 hours.
+
+### Security Considerations
+
+**Database Drivers**: Database drivers (pg, mysql2, sqlite3) are optional dependencies. Install only what you need to reduce your security surface:
+```bash
+npm install pg          # PostgreSQL
+npm install mysql2      # MySQL
+npm install sqlite3     # SQLite
+```
+
+**SQL Injection Protection**: IlanaORM uses parameterized queries via Knex.js. Always use query builder methods instead of raw SQL.
+
+**Filesystem Access**: The CLI and migration tools require filesystem access. Review migration files before running.
+
+**Network Access**: Database drivers make network connections. Ensure proper firewall and connection security.
+
 ## License
 
 MIT License - see the [LICENSE](LICENSE) file for details.

package/cli/ilana.js

@@ -90,6 +90,17 @@ function isESModuleProject() {
   return false;
 }
 
+function getProjectStructure() {
+  const hasSrc = fs.existsSync(path.join(process.cwd(), 'src'));
+  return {
+    hasSrc,
+    modelsDir: hasSrc ? 'src/models' : 'models',
+    databaseDir: hasSrc ? 'src/database' : 'database',
+    observersDir: hasSrc ? 'src/observers' : 'observers',
+    castsDir: hasSrc ? 'src/casts' : 'casts'
+  };
+}
+
 function getFileExtension() {
   return isTypeScriptProject() ? '.ts' : '.js';
 }
@@ -109,8 +120,9 @@ function pluralize(str) {
 }
 
 function getESModuleConfigTemplate() {
+  const structure = getProjectStructure();
   return `import 'dotenv/config';
-import Database from 'ilana-orm/database/connection';
+import Database from 'ilana-orm/database/connection.js';
 
 const config = {
   default: process.env.DB_CONNECTION || 'mysql',
@@ -150,12 +162,12 @@ const config = {
   },
   
   migrations: {
-    directory: './database/migrations',
+    directory: './${structure.databaseDir}/migrations',
     tableName: 'migrations'
   },
   
   seeds: {
-    directory: './database/seeds'
+    directory: './${structure.databaseDir}/seeds'
   }
 };
 
@@ -167,6 +179,7 @@ export default config;
 }
 
 function getCommonJSConfigTemplate() {
+  const structure = getProjectStructure();
   return `require('dotenv').config();
 const Database = require('ilana-orm/database/connection');
 
@@ -208,12 +221,12 @@ const config = {
   },
   
   migrations: {
-    directory: './database/migrations',
+    directory: './${structure.databaseDir}/migrations',
     tableName: 'migrations'
   },
   
   seeds: {
-    directory: './database/seeds'
+    directory: './${structure.databaseDir}/seeds'
   }
 };
 
@@ -228,7 +241,8 @@ function generateModel(name, options = {}) {
   const className = toPascalCase(name);
   const tableName = pluralize(toSnakeCase(name));
   const fileName = `${className}${getFileExtension()}`;
-  const filePath = path.join(process.cwd(), 'models', fileName);
+  const structure = getProjectStructure();
+  const filePath = path.join(process.cwd(), structure.modelsDir, fileName);
 
   if (fs.existsSync(filePath)) {
     console.error(`Model ${className} already exists at models/${fileName}`);
@@ -241,7 +255,7 @@ function generateModel(name, options = {}) {
 
   const template = options.pivot ? getPivotModelTemplate(className, tableName) : getModelTemplate(className, tableName);
   fs.writeFileSync(filePath, template);
-  console.log(`Created model: models/${fileName}`);
+  console.log(`Created model: ${structure.modelsDir}/${fileName}`);
 
   if (options.migration || options.all) {
     const migrationName = `create_${tableName}_table`;
@@ -449,15 +463,17 @@ module.exports = ${className};
 
 function generateFactory(className) {
   const fileName = `${className}Factory${getFileExtension()}`;
-  const filePath = path.join(process.cwd(), 'database/factories', fileName);
+  const structure = getProjectStructure();
+  const filePath = path.join(process.cwd(), structure.databaseDir, 'factories', fileName);
 
   if (!fs.existsSync(path.dirname(filePath))) {
     fs.mkdirSync(path.dirname(filePath), { recursive: true });
   }
 
+  const modelPath = structure.hasSrc ? `../models/${className}.js` : `../../models/${className}.js`;
   const template = isTypeScriptProject() ?
     `import { defineFactory } from 'ilana-orm/orm/Factory.js';
-import ${className} from '../../models/${className}.js';
+import ${className} from '${modelPath}';
 
 export default defineFactory(${className}, (faker) => ({
   // Define your factory attributes here
@@ -469,7 +485,7 @@ export default defineFactory(${className}, (faker) => ({
 }));
 ` :
     `const { defineFactory } = require('ilana-orm/orm/Factory');
-const ${className} = require('../../models/${className}');
+const ${className} = require('${modelPath.replace('.js', '')}');
 
 module.exports = defineFactory(${className}, (faker) => ({
   // Define your factory attributes here
@@ -482,20 +498,22 @@ module.exports = defineFactory(${className}, (faker) => ({
 `;
 
   fs.writeFileSync(filePath, template);
-  console.log(`Created factory: factories/${fileName}`);
+  console.log(`Created factory: ${structure.databaseDir}/factories/${fileName}`);
 }
 
 function generateSeeder(className) {
   const fileName = `${className}Seeder${getFileExtension()}`;
-  const filePath = path.join(process.cwd(), 'database/seeds', fileName);
+  const structure = getProjectStructure();
+  const filePath = path.join(process.cwd(), structure.databaseDir, 'seeds', fileName);
 
   if (!fs.existsSync(path.dirname(filePath))) {
     fs.mkdirSync(path.dirname(filePath), { recursive: true });
   }
 
+  const modelPath = structure.hasSrc ? `../models/${className}.js` : `../../models/${className}.js`;
   const template = isTypeScriptProject() ?
     `import Seeder from 'ilana-orm/orm/Seeder.js';
-import ${className} from '../../models/${className}.js';
+import ${className} from '${modelPath}';
 import '../factories/${className}Factory.js';
 
 export default class ${className}Seeder extends Seeder {
@@ -510,7 +528,7 @@ export default class ${className}Seeder extends Seeder {
 }
 ` :
     `const Seeder = require('ilana-orm/orm/Seeder');
-const ${className} = require('../../models/${className}');
+const ${className} = require('${modelPath.replace('.js', '')}');
 require('../factories/${className}Factory');
 
 class ${className}Seeder extends Seeder {
@@ -528,16 +546,16 @@ module.exports = ${className}Seeder;
 `;
 
   fs.writeFileSync(filePath, template);
-  console.log(`Created seeder: seeds/${fileName}`);
+  console.log(`Created seeder: ${structure.databaseDir}/seeds/${fileName}`);
 }
 
 function getObserverTemplate(className, modelName) {
   const isESModule = isESModuleProject();
-  
+
   if (isTypeScriptProject()) {
     const importStatement = modelName ? `import ${modelName} from '../models/${modelName}.js';\n\n` : '';
     const modelType = modelName || 'any';
-    
+
     return `${importStatement}export default class ${className}Observer {
   async creating(model: ${modelType}): Promise<void> {
     // Logic before creating model
@@ -581,10 +599,10 @@ function getObserverTemplate(className, modelName) {
 }
 `;
   }
-  
+
   if (isESModule) {
     const importStatement = modelName ? `import ${modelName} from '../models/${modelName}.js';\n\n` : '';
-    
+
     return `${importStatement}class ${className}Observer {
   async creating(model) {
     // Logic before creating model
@@ -630,9 +648,9 @@ function getObserverTemplate(className, modelName) {
 export default ${className}Observer;
 `;
   }
-  
+
   const importStatement = modelName ? `const ${modelName} = require('../models/${modelName}');\n\n` : '';
-  
+
   return `${importStatement}class ${className}Observer {
   async creating(model) {
     // Logic before creating model
@@ -681,7 +699,7 @@ module.exports = ${className}Observer;
 
 function getCastTemplate(className) {
   const isESModule = isESModuleProject();
-  
+
   if (isTypeScriptProject()) {
     return `export default class ${className}Cast {
   get(value: any): any {
@@ -696,7 +714,7 @@ function getCastTemplate(className) {
 }
 `;
   }
-  
+
   if (isESModule) {
     return `class ${className}Cast {
   get(value) {
@@ -713,7 +731,7 @@ function getCastTemplate(className) {
 export default ${className}Cast;
 `;
   }
-  
+
   return `class ${className}Cast {
   get(value) {
     // Transform value when retrieving from database
@@ -736,7 +754,13 @@ const commands = {
     console.log('Setting up Ilana ORM...');
 
     // Create directories
-    const dirs = ['models', 'database/migrations', 'database/factories', 'database/seeds'];
+    const structure = getProjectStructure();
+    const dirs = [
+      structure.modelsDir,
+      `${structure.databaseDir}/migrations`,
+      `${structure.databaseDir}/factories`,
+      `${structure.databaseDir}/seeds`
+    ];
     for (const dir of dirs) {
       if (!fs.existsSync(dir)) {
         fs.mkdirSync(dir, { recursive: true });
@@ -1053,7 +1077,8 @@ DB_TIMEZONE=UTC
       }
     }
 
-    const seedsPath = path.join(process.cwd(), 'database/seeds');
+    const structure = getProjectStructure();
+    const seedsPath = path.join(process.cwd(), structure.databaseDir, 'seeds');
     if (!fs.existsSync(seedsPath)) {
       console.log('No seeds directory found');
       process.exit(0);
@@ -1125,7 +1150,8 @@ DB_TIMEZONE=UTC
 
     const className = toPascalCase(name.replace('Observer', ''));
     const fileName = `${className}Observer${getFileExtension()}`;
-    const filePath = path.join(process.cwd(), 'observers', fileName);
+    const structure = getProjectStructure();
+    const filePath = path.join(process.cwd(), structure.observersDir, fileName);
 
     if (!fs.existsSync(path.dirname(filePath))) {
       fs.mkdirSync(path.dirname(filePath), { recursive: true });
@@ -1133,7 +1159,7 @@ DB_TIMEZONE=UTC
 
     const template = getObserverTemplate(className, modelName);
     fs.writeFileSync(filePath, template);
-    console.log(`Created observer: observers/${fileName}`);
+    console.log(`Created observer: ${structure.observersDir}/${fileName}`);
 
     if (modelName) {
       console.log(`Observer configured for model: ${modelName}`);
@@ -1149,7 +1175,8 @@ DB_TIMEZONE=UTC
 
     const className = toPascalCase(name.replace('Cast', ''));
     const fileName = `${className}Cast${getFileExtension()}`;
-    const filePath = path.join(process.cwd(), 'casts', fileName);
+    const structure = getProjectStructure();
+    const filePath = path.join(process.cwd(), structure.castsDir, fileName);
 
     if (!fs.existsSync(path.dirname(filePath))) {
       fs.mkdirSync(path.dirname(filePath), { recursive: true });
@@ -1157,7 +1184,7 @@ DB_TIMEZONE=UTC
 
     const template = getCastTemplate(className);
     fs.writeFileSync(filePath, template);
-    console.log(`Created cast: casts/${fileName}`);
+    console.log(`Created cast: ${structure.castsDir}/${fileName}`);
   },
 
   help() {

package/database/connection.js

@@ -10,17 +10,28 @@ class Database {
     
     // Initialize all configured connections
     for (const [name, connConfig] of Object.entries(config.connections)) {
-      const connection = knex({
-        ...connConfig,
-        migrations: config.migrations || {
-          directory: './migrations',
-          tableName: 'migrations'
-        },
-        seeds: config.seeds || {
-          directory: './seeds'
+      try {
+        const connection = knex({
+          ...connConfig,
+          migrations: config.migrations || {
+            directory: './migrations',
+            tableName: 'migrations'
+          },
+          seeds: config.seeds || {
+            directory: './seeds'
+          }
+        });
+        this.connections.set(name, connection);
+      } catch (error) {
+        if (error.code === 'MODULE_NOT_FOUND' && error.message.includes(connConfig.client)) {
+          const driverMap = { pg: 'pg', mysql2: 'mysql2', sqlite3: 'sqlite3' };
+          const driver = driverMap[connConfig.client] || connConfig.client;
+          throw new Error(
+            `Database driver '${driver}' not installed. Install it with: npm install ${driver}`
+          );
         }
-      });
-      this.connections.set(name, connection);
+        throw error;
+      }
     }
     
     // Set default instance after all connections are created

package/orm/Model.js

@@ -290,20 +290,7 @@ class Model {
     if (cast === 'json' || cast === 'array') {
       try { return JSON.parse(val); } catch { return val; }
     }
-    if (cast === 'date' && val != null) {
-      const config = this._getConfig();
-      const timezone = this.constructor.timezone || config?.timezone || 'UTC';
-
-      try {
-        // Try moment-timezone first
-        const moment = require('moment-timezone');
-        // Parse the stored value as if it's in the configured timezone
-        return moment.tz(val, timezone).format('YYYY-MM-DD HH:mm:ss');
-      } catch (e) {
-        // Fallback: return the stored value as-is since it's already in the correct timezone
-        return val;
-      }
-    }
+    if (cast === 'date' && val != null) return val;
     return val;
   }
 
@@ -337,38 +324,29 @@ class Model {
   }
 
   _getCurrentTimestamp() {
+    const now = new Date();
     const config = this._getConfig();
     const timezone = this.constructor.timezone || config?.timezone || 'UTC';
-
-    try {
-      // Try to use moment-timezone if available
-      const moment = require('moment-timezone');
-      return moment().tz(timezone).toDate();
-    } catch (e) {
-      try {
-        // Try to use date-fns-tz if available
-        const { zonedTimeToUtc } = require('date-fns-tz');
-        return zonedTimeToUtc(new Date(), timezone);
-      } catch (e2) {
-        // Fallback to simple but accurate method
-        const now = new Date();
-        if (timezone === 'UTC') return now;
-
-        // Use toLocaleString for accurate timezone conversion
-        const utcTime = now.getTime() + (now.getTimezoneOffset() * 60000);
-        const targetTime = new Date(utcTime + (this._getTimezoneOffset(timezone, now) * 60000));
-        return targetTime;
-      }
-    }
-  }
-
-  _getTimezoneOffset(timezone, date) {
+    
+    if (timezone === 'UTC') return now;
+    
     try {
-      const utcDate = new Date(date.toLocaleString('en-US', { timeZone: 'UTC' }));
-      const targetDate = new Date(date.toLocaleString('en-US', { timeZone: timezone }));
-      return (targetDate.getTime() - utcDate.getTime()) / 60000;
-    } catch (e) {
-      return 0; // Default to UTC
+      const formatter = new Intl.DateTimeFormat('en-US', {
+        timeZone: timezone,
+        year: 'numeric',
+        month: '2-digit',
+        day: '2-digit',
+        hour: '2-digit',
+        minute: '2-digit',
+        second: '2-digit',
+        hour12: false
+      });
+      const parts = Object.fromEntries(
+        formatter.formatToParts(now).map(p => [p.type, p.value])
+      );
+      return new Date(`${parts.year}-${parts.month}-${parts.day}T${parts.hour}:${parts.minute}:${parts.second}`);
+    } catch {
+      return now;
     }
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ilana-orm",
-  "version": "1.0.13",
+  "version": "1.0.15",
   "description": "A fully-featured, Eloquent-style ORM for Node.js with TypeScript support",
   "main": "index.js",
   "types": "index.d.ts",
@@ -114,14 +114,15 @@
     "ilana.png"
   ],
   "dependencies": {
-    "knex": "^3.0.0",
-    "uuid": "^9.0.0",
-    "@faker-js/faker": "^8.0.0",
-    "pg": "^8.0.0",
-    "mysql2": "^3.0.0",
-    "sqlite3": "^5.0.0",
-    "dotenv": "^16.3.1",
-    "moment-timezone": "^0.6.0"
+    "knex": "^3.1.0",
+    "uuid": "^10.0.0",
+    "@faker-js/faker": "^9.0.0",
+    "dotenv": "^16.4.0"
+  },
+  "optionalDependencies": {
+    "pg": "^8.13.0",
+    "mysql2": "^3.11.0",
+    "sqlite3": "^5.1.7"
   },
   "devDependencies": {
     "@types/node": "^20.0.0",