metal-orm 1.0.82 → 1.0.83

package/src/query-builder/select.ts

@@ -68,6 +68,7 @@ import { SelectCTEFacet } from './select/cte-facet.js';
 import { SelectSetOpFacet } from './select/setop-facet.js';
 import { SelectRelationFacet } from './select/relation-facet.js';
 import { buildFilterParameters, extractSchema, SchemaOptions, OpenApiSchemaBundle } from '../openapi/index.js';
+import { hasParamOperandsInQuery } from '../core/ast/ast-validation.js';
 
 type ColumnSelectionValue =
   | ColumnDef
@@ -713,120 +714,138 @@ export class SelectQueryBuilder<T = EntityInstance<TableDef>, TTable extends Tab
     return this.env.table as TTable;
   }
 
-  /**
-   * Ensures that if no columns are selected, all columns from the table are selected by default.
-   */
-  private ensureDefaultSelection(): SelectQueryBuilder<T, TTable> {
-    const columns = this.context.state.ast.columns;
-    if (!columns || columns.length === 0) {
-      const columnKeys = Object.keys(this.env.table.columns) as (keyof TTable['columns'] & string)[];
-      return this.select(...columnKeys);
-    }
-    return this;
-  }
-
-  /**
-   * Executes the query and returns hydrated results.
-   * If the builder was created with an entity constructor (e.g. via selectFromEntity),
-   * this will automatically return fully materialized entity instances.
-   *
-   * @param ctx - ORM session context
-   * @returns Promise of entity instances (or objects if generic T is not an entity)
-   * @example
-   * const users = await selectFromEntity(User).execute(session);
-   * // users is User[]
-   * users[0] instanceof User; // true
-   */
-  async execute(ctx: OrmSession): Promise<T[]> {
-    if (this.entityConstructor) {
-      return this.executeAs(this.entityConstructor, ctx) as unknown as T[];
-    }
-    const builder = this.ensureDefaultSelection();
-    return executeHydrated(ctx, builder) as unknown as T[];
-  }
+  /**
+   * Ensures that if no columns are selected, all columns from the table are selected by default.
+   */
+  private ensureDefaultSelection(): SelectQueryBuilder<T, TTable> {
+    const columns = this.context.state.ast.columns;
+    if (!columns || columns.length === 0) {
+      const columnKeys = Object.keys(this.env.table.columns) as (keyof TTable['columns'] & string)[];
+      return this.select(...columnKeys);
+    }
+    return this;
+  }
+
+  /**
+   * Validates that the query does not contain Param operands.
+   * Param proxies are only for schema generation, not execution.
+   */
+  private validateNoParamOperands(): void {
+    const ast = this.context.hydration.applyToAst(this.context.state.ast);
+    const hasParams = hasParamOperandsInQuery(ast);
+    if (hasParams) {
+      throw new Error('Cannot execute query containing Param operands. Param proxies are only for schema generation (getSchema()). If you need real parameters, use literal values.');
+    }
+  }
 
-  /**
-   * Executes the query and returns plain row objects (POJOs), ignoring any entity materialization.
-   * Use this if you want raw data even when using selectFromEntity.
-   *
-   * @param ctx - ORM session context
-   * @returns Promise of plain entity instances
-   * @example
-   * const rows = await selectFromEntity(User).executePlain(session);
-   * // rows is EntityInstance<UserTable>[] (plain objects)
-   * rows[0] instanceof User; // false
-   */
-  async executePlain(ctx: OrmSession): Promise<EntityInstance<TTable>[]> {
-    const builder = this.ensureDefaultSelection();
-    const rows = await executeHydratedPlain(ctx, builder);
-    return rows as EntityInstance<TTable>[];
-  }
+  /**
+   * Executes the query and returns hydrated results.
+   * If the builder was created with an entity constructor (e.g. via selectFromEntity),
+   * this will automatically return fully materialized entity instances.
+   *
+   * @param ctx - ORM session context
+   * @returns Promise of entity instances (or objects if generic T is not an entity)
+   * @example
+   * const users = await selectFromEntity(User).execute(session);
+   * // users is User[]
+   * users[0] instanceof User; // true
+   */
+  async execute(ctx: OrmSession): Promise<T[]> {
+    this.validateNoParamOperands();
+    if (this.entityConstructor) {
+      return this.executeAs(this.entityConstructor, ctx) as unknown as T[];
+    }
+    const builder = this.ensureDefaultSelection();
+    return executeHydrated(ctx, builder) as unknown as T[];
+  }
 
-  /**
-   * Executes the query and returns results as real class instances.
-   * Unlike execute(), this returns actual instances of the decorated entity class
-   * with working methods and proper instanceof checks.
-   * @param entityClass - The entity class constructor
-   * @param ctx - ORM session context
-   * @returns Promise of entity class instances
-   * @example
-   * const users = await selectFromEntity(User)
-   *   .include('posts')
-   *   .executeAs(User, session);
-   * users[0] instanceof User; // true!
-   * users[0].getFullName();   // works!
-   */
-  async executeAs<TEntity extends object>(
-    entityClass: EntityConstructor<TEntity>,
-    ctx: OrmSession
-  ): Promise<TEntity[]> {
-    const builder = this.ensureDefaultSelection();
-    const results = await executeHydrated(ctx, builder);
-    return materializeAs(entityClass, results as unknown as Record<string, unknown>[]);
-  }
+  /**
+   * Executes the query and returns plain row objects (POJOs), ignoring any entity materialization.
+   * Use this if you want raw data even when using selectFromEntity.
+   *
+   * @param ctx - ORM session context
+   * @returns Promise of plain entity instances
+   * @example
+   * const rows = await selectFromEntity(User).executePlain(session);
+   * // rows is EntityInstance<UserTable>[] (plain objects)
+   * rows[0] instanceof User; // false
+   */
+  async executePlain(ctx: OrmSession): Promise<EntityInstance<TTable>[]> {
+    this.validateNoParamOperands();
+    const builder = this.ensureDefaultSelection();
+    const rows = await executeHydratedPlain(ctx, builder);
+    return rows as EntityInstance<TTable>[];
+  }
 
-  /**
-   * Executes a count query for the current builder without LIMIT/OFFSET clauses.
-   *
-   * @example
-   * const total = await qb.count(session);
-   */
-  async count(session: OrmSession): Promise<number> {
-    return executeCount(this.context, this.env, session);
-  }
+  /**
+   * Executes the query and returns results as real class instances.
+   * Unlike execute(), this returns actual instances of the decorated entity class
+   * with working methods and proper instanceof checks.
+   * @param entityClass - The entity class constructor
+   * @param ctx - ORM session context
+   * @returns Promise of entity class instances
+   * @example
+   * const users = await selectFromEntity(User)
+   *   .include('posts')
+   *   .executeAs(User, session);
+   * users[0] instanceof User; // true!
+   * users[0].getFullName();   // works!
+   */
+  async executeAs<TEntity extends object>(
+    entityClass: EntityConstructor<TEntity>,
+    ctx: OrmSession
+  ): Promise<TEntity[]> {
+    this.validateNoParamOperands();
+    const builder = this.ensureDefaultSelection();
+    const results = await executeHydrated(ctx, builder);
+    return materializeAs(entityClass, results as unknown as Record<string, unknown>[]);
+  }
 
-  /**
-   * Executes the query and returns both the paged items and the total.
-   *
-   * @example
-   * const { items, totalItems, page, pageSize } = await qb.executePaged(session, { page: 1, pageSize: 20 });
-   */
-  async executePaged(
-    session: OrmSession,
-    options: { page: number; pageSize: number }
-  ): Promise<PaginatedResult<T>> {
-    const builder = this.ensureDefaultSelection();
-    return executePagedQuery(builder, session, options, sess => builder.count(sess));
-  }
+  /**
+   * Executes a count query for the current builder without LIMIT/OFFSET clauses.
+   *
+   * @example
+   * const total = await qb.count(session);
+   */
+  async count(session: OrmSession): Promise<number> {
+    this.validateNoParamOperands();
+    return executeCount(this.context, this.env, session);
+  }
+
+  /**
+   * Executes the query and returns both the paged items and the total.
+   *
+   * @example
+   * const { items, totalItems, page, pageSize } = await qb.executePaged(session, { page: 1, pageSize: 20 });
+   */
+  async executePaged(
+    session: OrmSession,
+    options: { page: number; pageSize: number }
+  ): Promise<PaginatedResult<T>> {
+    this.validateNoParamOperands();
+    const builder = this.ensureDefaultSelection();
+    return executePagedQuery(builder, session, options, sess => builder.count(sess));
+  }
 
-  /**
-   * Executes the query with provided execution and hydration contexts
-   * @param execCtx - Execution context
-   * @param hydCtx - Hydration context
-   * @returns Promise of entity instances
-   * @example
-   * const execCtx = new ExecutionContext(session);
-   * const hydCtx = new HydrationContext();
-   * const users = await qb.executeWithContexts(execCtx, hydCtx);
-   */
-  async executeWithContexts(execCtx: ExecutionContext, hydCtx: HydrationContext): Promise<T[]> {
-    const builder = this.ensureDefaultSelection();
-    const results = await executeHydratedWithContexts(execCtx, hydCtx, builder);
-    if (this.entityConstructor) {
-      return materializeAs(this.entityConstructor, results as unknown as Record<string, unknown>[]) as unknown as T[];
-    }
-    return results as unknown as T[];
-  }
+  /**
+   * Executes the query with provided execution and hydration contexts
+   * @param execCtx - Execution context
+   * @param hydCtx - Hydration context
+   * @returns Promise of entity instances
+   * @example
+   * const execCtx = new ExecutionContext(session);
+   * const hydCtx = new HydrationContext();
+   * const users = await qb.executeWithContexts(execCtx, hydCtx);
+   */
+  async executeWithContexts(execCtx: ExecutionContext, hydCtx: HydrationContext): Promise<T[]> {
+    this.validateNoParamOperands();
+    const builder = this.ensureDefaultSelection();
+    const results = await executeHydratedWithContexts(execCtx, hydCtx, builder);
+    if (this.entityConstructor) {
+      return materializeAs(this.entityConstructor, results as unknown as Record<string, unknown>[]) as unknown as T[];
+    }
+    return results as unknown as T[];
+  }
 
   /**
    * Adds a WHERE condition to the query