joist-core 2.4.0-next.3 → 2.4.0-next.4

package/build/queries/sql/query.cjs

@@ -1294,19 +1294,19 @@ function checkCondition(value) {
 	if ("and" in condition || "or" in condition) {
 		if ("and" in condition === "or" in condition) require_utils.fail("Query conditions require exactly one and/or group");
 		const key = "and" in condition ? "and" : "or";
-		checkConditionKeys(condition, [key, "pruneIfUndefined"], "Query condition group");
+		checkPojoKeys(condition, [key, "pruneIfUndefined"], "Query condition group");
 		if (!Array.isArray(condition[key])) require_utils.fail("Query condition groups require an array");
 		if (condition.pruneIfUndefined !== void 0 && condition.pruneIfUndefined !== "any" && condition.pruneIfUndefined !== "all") require_utils.fail("Invalid query pruneIfUndefined policy");
 		for (const child of condition[key]) checkCondition(child);
 	} else if ("exists" in condition || "notExists" in condition) {
 		const key = "exists" in condition ? "exists" : "notExists";
-		checkConditionKeys(condition, [key], "Query existence condition");
+		checkPojoKeys(condition, [key], "Query existence condition");
 		const query = condition[key];
 		if (query === void 0) return;
 		if (!(query instanceof SubqueryExpr) && !isReadQueryValue(query)) require_utils.fail(`Query ${key} requires a query(...) value`);
 		toQuery(query);
 	} else if (condition.kind === "raw") {
-		checkConditionKeys(condition, [
+		checkPojoKeys(condition, [
 			"kind",
 			"aliases",
 			"condition",
@@ -1317,7 +1317,7 @@ function checkCondition(value) {
 		], "Query raw condition");
 		if (typeof condition.condition !== "string" || !Array.isArray(condition.aliases) || !condition.aliases.every((alias) => typeof alias === "string") || !Array.isArray(condition.bindings) || typeof condition.pruneable !== "boolean") require_utils.fail("Malformed query raw condition");
 	} else if (condition.kind === "column") {
-		checkConditionKeys(condition, [
+		checkPojoKeys(condition, [
 			"kind",
 			"alias",
 			"column",
@@ -1329,7 +1329,7 @@ function checkCondition(value) {
 		if (typeof condition.alias !== "string" || typeof condition.column !== "string" || typeof condition.dbType !== "string" || condition.pruneable !== void 0 && typeof condition.pruneable !== "boolean") require_utils.fail("Malformed query column condition");
 		const filter = condition.cond;
 		if (!filter) require_utils.fail("Malformed query column filter");
-		checkConditionKeys(filter, ["kind", "value"], "Query column filter");
+		checkPojoKeys(filter, ["kind", "value"], "Query column filter");
 		const unary = filter.kind === "is-null" || filter.kind === "not-null";
 		if (!unary && (![
 			"eq",
@@ -1360,8 +1360,18 @@ function checkCondition(value) {
 		if (unary && "value" in filter) require_utils.fail("Unary query filters do not accept values");
 	} else require_utils.fail("Unknown query condition");
 }
-/** Conditions use own enumerable POJO fields, with predicate-brand and SQL-resolver symbols allowed. */
-function checkConditionKeys(value, allowed, description) {
+/**
+* Accepts only own enumerable POJO fields, so nothing a caller supplied can be silently ignored: the
+* compilers read these POJOs back with `Object.entries`/`Object.keys`, which skip inherited,
+* non-enumerable, and symbol keys, so a field hidden behind one of those would never reach the SQL.
+* I.e. an UPDATE whose `set` carries `title` on a prototype would leave `title` unchanged and still
+* report success.
+*
+* Conditions, mutation clauses, and assignment POJOs all share this rule; `allowed` may include symbol
+* keys, i.e. a condition's predicate brand and SQL resolver. Read-query clauses instead use
+* `validateQueryKeys`, which walks the prototype chain and reports mutation clauses by name.
+*/
+function checkPojoKeys(value, allowed, description) {
 	if (Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null) require_utils.fail(`${description} must be a plain POJO`);
 	for (const key of Reflect.ownKeys(value)) {
 		if (!allowed.includes(key)) require_utils.fail(`${description} does not support '${String(key)}'`);
@@ -1590,6 +1600,7 @@ function typedSql(strings, ...values) {
 //#endregion
 exports.Ctx = Ctx;
 exports.SubqueryHandle = SubqueryHandle;
+exports.checkPojoKeys = checkPojoKeys;
 exports.conditionToSql = conditionToSql;
 exports.entityQueryBrand = entityQueryBrand;
 exports.injectedConditions = injectedConditions;