ilana-orm 1.0.14 → 1.0.15

package/README.md

@@ -104,17 +104,23 @@ A fully-featured, Eloquent-style ORM for Node.js with automatic TypeScript suppo
 ## Installation
 
 ```bash
-# npm
 npm install ilana-orm
+```
 
-# yarn
-yarn add ilana-orm
+### Database Drivers
 
-# pnpm
-pnpm add ilana-orm
-```
+Install only the database driver you need:
 
-**All database drivers (PostgreSQL, MySQL, SQLite) and dotenv are included by default** - no additional installation required!
+```bash
+# PostgreSQL
+npm install pg
+
+# MySQL
+npm install mysql2
+
+# SQLite
+npm install sqlite3
+```
 
 ## Quick Start
 
@@ -4771,6 +4777,32 @@ class CustomCast {
 
 We welcome contributions! Please see our [Contributing Guide](CONTRIBUTING.md) for details.
 
+## Security
+
+### Reporting Vulnerabilities
+
+If you discover a security vulnerability, please email raphyabak@gmail.com with:
+- Description of the vulnerability
+- Steps to reproduce
+- Potential impact
+
+We will respond within 48 hours.
+
+### Security Considerations
+
+**Database Drivers**: Database drivers (pg, mysql2, sqlite3) are optional dependencies. Install only what you need to reduce your security surface:
+```bash
+npm install pg          # PostgreSQL
+npm install mysql2      # MySQL
+npm install sqlite3     # SQLite
+```
+
+**SQL Injection Protection**: IlanaORM uses parameterized queries via Knex.js. Always use query builder methods instead of raw SQL.
+
+**Filesystem Access**: The CLI and migration tools require filesystem access. Review migration files before running.
+
+**Network Access**: Database drivers make network connections. Ensure proper firewall and connection security.
+
 ## License
 
 MIT License - see the [LICENSE](LICENSE) file for details.

package/database/connection.js

@@ -10,17 +10,28 @@ class Database {
     
     // Initialize all configured connections
     for (const [name, connConfig] of Object.entries(config.connections)) {
-      const connection = knex({
-        ...connConfig,
-        migrations: config.migrations || {
-          directory: './migrations',
-          tableName: 'migrations'
-        },
-        seeds: config.seeds || {
-          directory: './seeds'
+      try {
+        const connection = knex({
+          ...connConfig,
+          migrations: config.migrations || {
+            directory: './migrations',
+            tableName: 'migrations'
+          },
+          seeds: config.seeds || {
+            directory: './seeds'
+          }
+        });
+        this.connections.set(name, connection);
+      } catch (error) {
+        if (error.code === 'MODULE_NOT_FOUND' && error.message.includes(connConfig.client)) {
+          const driverMap = { pg: 'pg', mysql2: 'mysql2', sqlite3: 'sqlite3' };
+          const driver = driverMap[connConfig.client] || connConfig.client;
+          throw new Error(
+            `Database driver '${driver}' not installed. Install it with: npm install ${driver}`
+          );
         }
-      });
-      this.connections.set(name, connection);
+        throw error;
+      }
     }
     
     // Set default instance after all connections are created

package/orm/Model.js

@@ -290,20 +290,7 @@ class Model {
     if (cast === 'json' || cast === 'array') {
       try { return JSON.parse(val); } catch { return val; }
     }
-    if (cast === 'date' && val != null) {
-      const config = this._getConfig();
-      const timezone = this.constructor.timezone || config?.timezone || 'UTC';
-
-      try {
-        // Try moment-timezone first
-        const moment = require('moment-timezone');
-        // Parse the stored value as if it's in the configured timezone
-        return moment.tz(val, timezone).format('YYYY-MM-DD HH:mm:ss');
-      } catch (e) {
-        // Fallback: return the stored value as-is since it's already in the correct timezone
-        return val;
-      }
-    }
+    if (cast === 'date' && val != null) return val;
     return val;
   }
 
@@ -337,38 +324,29 @@ class Model {
   }
 
   _getCurrentTimestamp() {
+    const now = new Date();
     const config = this._getConfig();
     const timezone = this.constructor.timezone || config?.timezone || 'UTC';
-
-    try {
-      // Try to use moment-timezone if available
-      const moment = require('moment-timezone');
-      return moment().tz(timezone).toDate();
-    } catch (e) {
-      try {
-        // Try to use date-fns-tz if available
-        const { zonedTimeToUtc } = require('date-fns-tz');
-        return zonedTimeToUtc(new Date(), timezone);
-      } catch (e2) {
-        // Fallback to simple but accurate method
-        const now = new Date();
-        if (timezone === 'UTC') return now;
-
-        // Use toLocaleString for accurate timezone conversion
-        const utcTime = now.getTime() + (now.getTimezoneOffset() * 60000);
-        const targetTime = new Date(utcTime + (this._getTimezoneOffset(timezone, now) * 60000));
-        return targetTime;
-      }
-    }
-  }
-
-  _getTimezoneOffset(timezone, date) {
+    
+    if (timezone === 'UTC') return now;
+    
     try {
-      const utcDate = new Date(date.toLocaleString('en-US', { timeZone: 'UTC' }));
-      const targetDate = new Date(date.toLocaleString('en-US', { timeZone: timezone }));
-      return (targetDate.getTime() - utcDate.getTime()) / 60000;
-    } catch (e) {
-      return 0; // Default to UTC
+      const formatter = new Intl.DateTimeFormat('en-US', {
+        timeZone: timezone,
+        year: 'numeric',
+        month: '2-digit',
+        day: '2-digit',
+        hour: '2-digit',
+        minute: '2-digit',
+        second: '2-digit',
+        hour12: false
+      });
+      const parts = Object.fromEntries(
+        formatter.formatToParts(now).map(p => [p.type, p.value])
+      );
+      return new Date(`${parts.year}-${parts.month}-${parts.day}T${parts.hour}:${parts.minute}:${parts.second}`);
+    } catch {
+      return now;
     }
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ilana-orm",
-  "version": "1.0.14",
+  "version": "1.0.15",
   "description": "A fully-featured, Eloquent-style ORM for Node.js with TypeScript support",
   "main": "index.js",
   "types": "index.d.ts",
@@ -114,14 +114,15 @@
     "ilana.png"
   ],
   "dependencies": {
-    "knex": "^3.0.0",
-    "uuid": "^9.0.0",
-    "@faker-js/faker": "^8.0.0",
-    "pg": "^8.0.0",
-    "mysql2": "^3.0.0",
-    "sqlite3": "^5.0.0",
-    "dotenv": "^16.3.1",
-    "moment-timezone": "^0.6.0"
+    "knex": "^3.1.0",
+    "uuid": "^10.0.0",
+    "@faker-js/faker": "^9.0.0",
+    "dotenv": "^16.4.0"
+  },
+  "optionalDependencies": {
+    "pg": "^8.13.0",
+    "mysql2": "^3.11.0",
+    "sqlite3": "^5.1.7"
   },
   "devDependencies": {
     "@types/node": "^20.0.0",