inibase 3.3.0 → 3.5.0

package/README.md

@@ -206,7 +206,7 @@ interface {
 
 ```ts
 interface Field {
-  id: number; // stored as a Number but displayed as a hashed ID
+  id: number; // position in the schema; 0 = the row id, -1 = createdAt, -2 = updatedAt
   key: string;
   required?: boolean;
   unique?: boolean | string; // boolean for simple uniqueness, string for grouped uniqueness
@@ -402,6 +402,30 @@ const userTableSchema = [
 await db.createTable("user", userTableSchema, userTableConfig);
 ```
 
+#### `decodeID`
+
+By default a row's `id` is stored as a number but only ever handed back as an
+encrypted (`aes-256-cbc`, hex) string, so ids can't be guessed by incrementing.
+Set `decodeID: true` and the id is exposed as the **plain number** everywhere —
+`get` rows, `get`/`put`/`delete` by id, relation lookups, and the id returned by
+`post`:
+
+```js
+const db = new Inibase("/databaseName");
+await db.createTable("item", [{ key: "name", type: "string" }], {
+  decodeID: true,
+});
+
+const id = await db.post("item", { name: "widget" }); // => 1  (a number)
+await db.get("item", 1); // works with the raw number
+```
+
+So `post` returns a `number` on a `decodeID` table and an encrypted `string` on
+every other table — in TypeScript its return type is `string | number`
+(`(string | number)[]` for a bulk post). Encrypted ids stay valid inputs on a
+`decodeID` table too, so existing clients that round-trip an id keep working
+either way. `decodeID` can be toggled later with `updateTable`.
+
 </blockquote>
 </details>
 

package/dist/file.js

@@ -377,7 +377,33 @@ export const isExists = async (path) => {
     }
 };
 /**
- * Secures input by encoding/escaping characters.
+ * Marks a cell written with the lossless string escaping below. It is a
+ * control character that never starts a legacy cell in practice, is not
+ * `[`/`{` (so the value is never mistaken for Inison) and is not numeric.
+ */
+const ESCAPED_STRING_PREFIX = "\u0001";
+/**
+ * Lossless escaping for strings that the legacy newline-only escaping cannot
+ * round-trip: `\` becomes `\\`, CR becomes `\r`, LF becomes `\n`.
+ */
+const escapeString = (input) => ESCAPED_STRING_PREFIX +
+    input.replace(/[\\\r\n]/g, (char) => char === "\\" ? "\\\\" : char === "\r" ? "\\r" : "\\n");
+/** Reverses {@link escapeString} (input includes the prefix). */
+const unescapeString = (input) => input
+    .slice(ESCAPED_STRING_PREFIX.length)
+    .replace(/\\([\\rn])/g, (_match, char) => char === "\\" ? "\\" : char === "r" ? "\r" : "\n");
+/**
+ * Secures input by encoding/escaping characters so a value fits on one line
+ * of a column file and reads back exactly as it was written.
+ *
+ * - The string is stored as given: it is NOT URI-decoded (`%20`, `50%`,
+ *   `%D8%A7` are data, not transport encoding).
+ * - Strings without `\` or CR keep the legacy format (LF stored as `\n`), so
+ *   existing files, native whole-line search and most new writes are
+ *   byte-identical to before.
+ * - Strings containing `\` or CR (or starting with the marker) use the
+ *   lossless format, because in the legacy format a literal `\n` typed by the
+ *   user is indistinguishable from an escaped line break.
  *
  * @param input - String, number, boolean, or null.
  * @returns Encoded string for true/false, special characters in strings, or original input.
@@ -390,15 +416,11 @@ const secureString = (input) => {
             return "";
         return input;
     }
-    let decodedInput = null;
-    try {
-        decodedInput = decodeURIComponent(input);
-    }
-    catch (_error) {
-        decodedInput = decodeURIComponent(input.replace(/%(?![0-9][0-9a-fA-F]+)/g, ""));
-    }
-    // Replace characters using a single regular expression.
-    return decodedInput.replace(/\r\n|\r|\n/g, "\\n");
+    if (input.includes("\\") ||
+        input.includes("\r") ||
+        input.startsWith(ESCAPED_STRING_PREFIX))
+        return escapeString(input);
+    return input.replace(/\n/g, "\\n");
 };
 /**
  * Encodes the input using 'secureString' and 'Inison.stringify' functions.
@@ -425,8 +447,10 @@ export const encode = (input) => Array.isArray(input)
 const unSecureString = (input) => {
     if (isNumber(input))
         return String(input).at(0) === "0" ? input : Number(input);
-    // Fast path: the common case has no `\n` escape sequence, so avoid
-    // allocating a replacement string (and a fresh RegExp) per cell.
+    if (typeof input === "string" && input.startsWith(ESCAPED_STRING_PREFIX))
+        return unescapeString(input);
+    // Legacy format. Fast path: the common case has no `\n` escape sequence,
+    // so avoid allocating a replacement string (and a fresh RegExp) per cell.
     if (typeof input === "string")
         return input.includes("\\n")
             ? input.replaceAll("\\n", "\n") || null

package/dist/index.d.ts

@@ -384,9 +384,13 @@ export default class Inibase {
      * @param {Options} [options] Pagination options, useful when the returnPostedData param is true
      * @param {boolean} [returnPostedData] By default function returns void, if you want to get the posted data, set this param to true
      * @return {*}  {Promise<Data | Data[] | null | void>}
+     *
+     * @remarks Without `returnPostedData` the return value is the new id: a
+     * `number` on a table created with `decodeID: true`, an encrypted
+     * `string` on every other table.
      */
-    post<TData extends Record<string, any> & Partial<Data>>(tableName: string, data: Data & TData, options?: Options, returnPostedData?: boolean): Promise<string>;
-    post<TData extends Record<string, any> & Partial<Data>>(tableName: string, data: (Data & TData)[], options?: Options, returnPostedData?: boolean): Promise<string[]>;
+    post<TData extends Record<string, any> & Partial<Data>>(tableName: string, data: Data & TData, options?: Options, returnPostedData?: boolean): Promise<string | number>;
+    post<TData extends Record<string, any> & Partial<Data>>(tableName: string, data: (Data & TData)[], options?: Options, returnPostedData?: boolean): Promise<(string | number)[]>;
     post<TData extends Record<string, any> & Partial<Data>>(tableName: string, data: Data & TData, options: Options | undefined, returnPostedData: true): Promise<(Data & TData) | null>;
     post<TData extends Record<string, any> & Partial<Data>>(tableName: string, data: (Data & TData)[], options: Options | undefined, returnPostedData: true): Promise<(Data & TData)[] | null>;
     private _post;

package/dist/index.js

@@ -2902,12 +2902,18 @@ export default class Inibase {
                         : this.totalItems.get(`${tableName}-*`), options, !Utils.isArrayOfObjects(clonedData), // return only one item if data is not array of objects
                 undefined, true);
             }
+            // On a decodeID table the id *is* the plain number — that is the
+            // whole point of the config: get(), put(), delete() and the
+            // returnPostedData read all hand back raw numbers, so post() must
+            // not encode it here. Every other table keeps returning the
+            // encrypted id.
+            const tableConfig = globalConfig[this.databasePath].tables?.get(tableName)?.config;
+            const postedID = (id) => tableConfig?.decodeID === true
+                ? Number(id)
+                : UtilsServer.encodeID(id);
             return Array.isArray(clonedData)
-                ? (globalConfig[this.databasePath].tables?.get(tableName)?.config
-                    .prepend
-                    ? clonedData.toReversed()
-                    : clonedData).map(({ id }) => UtilsServer.encodeID(id))
-                : UtilsServer.encodeID(clonedData.id);
+                ? (tableConfig?.prepend ? clonedData.toReversed() : clonedData).map(({ id }) => postedID(id))
+                : postedID(clonedData.id);
         }
         finally {
             if (this.transaction) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "inibase",
-  "version": "3.3.0",
+  "version": "3.5.0",
   "type": "module",
   "author": {
     "name": "Karim Amahtil",
@@ -88,7 +88,7 @@
     "benchmark": "./benchmark/run.js",
     "benchmark:durability": "tsx ./benchmark/durability.ts",
     "benchmark:computed": "tsx ./benchmark/computed.ts",
-    "test": "tsx ./tests/inibase.test.ts && tsx ./tests/inibase.advanced.test.ts && tsx ./tests/transaction.test.ts && tsx ./tests/durability.test.ts && tsx ./tests/expression.test.ts && tsx ./tests/utils.test.ts && tsx ./tests/sum.nested.test.ts && tsx ./tests/computed.child.test.ts && tsx ./tests/hardening.test.ts",
+    "test": "tsx ./tests/inibase.test.ts && tsx ./tests/inibase.advanced.test.ts && tsx ./tests/transaction.test.ts && tsx ./tests/durability.test.ts && tsx ./tests/expression.test.ts && tsx ./tests/utils.test.ts && tsx ./tests/sum.nested.test.ts && tsx ./tests/computed.child.test.ts && tsx ./tests/hardening.test.ts && tsx ./tests/string.roundtrip.test.ts",
     "test:durability": "tsx ./tests/durability.test.ts",
     "test:transaction": "tsx ./tests/transaction.test.ts",
     "test:utils": "tsx ./tests/utils.test.ts",