noormme 1.0.0 → 1.0.2

package/dist/cjs/util/safe-sql-helpers.js

@@ -0,0 +1,221 @@
+"use strict";
+/**
+ * Safe SQL helper utilities
+ * Provides secure alternatives to dangerous sql.raw() and sql.lit() methods
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SafeSQLExamples = exports.SafeSQLKeywords = void 0;
+exports.safeOrderDirection = safeOrderDirection;
+exports.safeLimit = safeLimit;
+exports.safeOffset = safeOffset;
+exports.safeKeyword = safeKeyword;
+exports.safeLockMode = safeLockMode;
+exports.safeOrderBy = safeOrderBy;
+exports.safeBoolean = safeBoolean;
+exports.safeCaseStatement = safeCaseStatement;
+exports.validateEnum = validateEnum;
+exports.validateNumericRange = validateNumericRange;
+const sql_js_1 = require("../raw-builder/sql.js");
+/**
+ * Safely creates a SQL ORDER BY direction clause
+ * Only allows 'ASC' or 'DESC'
+ */
+function safeOrderDirection(direction) {
+    const normalized = direction.toUpperCase().trim();
+    if (normalized !== 'ASC' && normalized !== 'DESC') {
+        throw new Error(`Invalid order direction: "${direction}". Only "ASC" and "DESC" are allowed.`);
+    }
+    return sql_js_1.sql.raw(normalized);
+}
+/**
+ * Safely creates a SQL LIMIT clause
+ * Validates that the limit is a positive integer
+ */
+function safeLimit(limit) {
+    const numLimit = typeof limit === 'string' ? parseInt(limit, 10) : limit;
+    if (!Number.isInteger(numLimit) || numLimit <= 0 || numLimit > 10000) {
+        throw new Error(`Invalid limit: "${limit}". Must be a positive integer between 1 and 10000.`);
+    }
+    return sql_js_1.sql.raw(numLimit.toString());
+}
+/**
+ * Safely creates a SQL OFFSET clause
+ * Validates that the offset is a non-negative integer
+ */
+function safeOffset(offset) {
+    const numOffset = typeof offset === 'string' ? parseInt(offset, 10) : offset;
+    if (!Number.isInteger(numOffset) || numOffset < 0 || numOffset > 1000000) {
+        throw new Error(`Invalid offset: "${offset}". Must be a non-negative integer between 0 and 1000000.`);
+    }
+    return sql_js_1.sql.raw(numOffset.toString());
+}
+/**
+ * Safely creates SQL keywords from a whitelist
+ * Useful for database-specific syntax that must be hardcoded
+ */
+function safeKeyword(keyword, allowedKeywords) {
+    const normalized = keyword.toUpperCase().trim();
+    const allowedNormalized = allowedKeywords.map(k => k.toUpperCase().trim());
+    if (!allowedNormalized.includes(normalized)) {
+        throw new Error(`Invalid keyword: "${keyword}". Allowed keywords: ${allowedKeywords.join(', ')}`);
+    }
+    return sql_js_1.sql.raw(normalized);
+}
+/**
+ * Type-safe enum for common SQL keywords
+ */
+exports.SafeSQLKeywords = {
+    /**
+     * Lock modes for SELECT statements
+     */
+    LockMode: {
+        FOR_UPDATE: 'FOR UPDATE',
+        FOR_SHARE: 'FOR SHARE',
+        FOR_NO_KEY_UPDATE: 'FOR NO KEY UPDATE',
+        FOR_KEY_SHARE: 'FOR KEY SHARE',
+    },
+    /**
+     * Join types
+     */
+    JoinType: {
+        INNER: 'INNER',
+        LEFT: 'LEFT',
+        RIGHT: 'RIGHT',
+        FULL: 'FULL',
+        CROSS: 'CROSS',
+    },
+    /**
+     * Set operations
+     */
+    SetOperation: {
+        UNION: 'UNION',
+        UNION_ALL: 'UNION ALL',
+        INTERSECT: 'INTERSECT',
+        EXCEPT: 'EXCEPT',
+    },
+    /**
+     * SQLite-specific pragmas (use with extreme caution)
+     */
+    SafePragma: {
+        OPTIMIZE: 'OPTIMIZE',
+        WAL_CHECKPOINT: 'WAL_CHECKPOINT',
+    },
+};
+/**
+ * Safely creates a lock mode clause for SELECT statements
+ */
+function safeLockMode(mode) {
+    return sql_js_1.sql.raw(exports.SafeSQLKeywords.LockMode[mode]);
+}
+/**
+ * Creates a safe ORDER BY clause from validated columns
+ */
+function safeOrderBy(orderBy, allowedColumns) {
+    if (orderBy.length === 0) {
+        throw new Error('At least one order by clause is required');
+    }
+    const clauses = orderBy.map(({ column, direction = 'ASC' }) => {
+        if (!allowedColumns.includes(column)) {
+            throw new Error(`Invalid order by column: "${column}". Allowed columns: ${allowedColumns.join(', ')}`);
+        }
+        const dir = direction.toUpperCase();
+        if (dir !== 'ASC' && dir !== 'DESC') {
+            throw new Error(`Invalid direction: "${direction}". Must be ASC or DESC`);
+        }
+        return `${column} ${dir}`;
+    });
+    return sql_js_1.sql.raw(clauses.join(', '));
+}
+/**
+ * Validates and creates a safe boolean value for SQL
+ */
+function safeBoolean(value) {
+    let boolValue;
+    if (typeof value === 'boolean') {
+        boolValue = value;
+    }
+    else if (value === 'true' || value === '1' || value === 1) {
+        boolValue = true;
+    }
+    else if (value === 'false' || value === '0' || value === 0) {
+        boolValue = false;
+    }
+    else {
+        throw new Error(`Invalid boolean value: "${value}". Must be true, false, 1, 0, "true", or "false"`);
+    }
+    // Use parameterized value instead of raw SQL
+    return (0, sql_js_1.sql) `${boolValue}`;
+}
+function safeCaseStatement(cases, elseResult) {
+    if (cases.length === 0) {
+        throw new Error('At least one WHEN clause is required');
+    }
+    // Note: This function needs to be refactored to not use sql.raw()
+    // For now, we construct the CASE statement carefully
+    const whenClauses = cases
+        .map((c, i) => {
+        // Conditions must be RawBuilder instances to ensure they're safe
+        const conditionSql = c.condition.toOperationNode();
+        return `WHEN ${conditionSql} THEN ${c.result}`;
+    })
+        .join(' ');
+    return sql_js_1.sql.raw(`CASE ${whenClauses} ELSE ${elseResult} END`);
+}
+/**
+ * Example usage and best practices
+ */
+exports.SafeSQLExamples = {
+    /**
+     * Example: Safe pagination with user input
+     */
+    safePagination: () => {
+        const userPage = '2'; // From request
+        const userLimit = '10'; // From request
+        const offset = (parseInt(userPage) - 1) * parseInt(userLimit);
+        return {
+            limit: safeLimit(userLimit),
+            offset: safeOffset(offset),
+        };
+    },
+    /**
+     * Example: Safe sorting with user input
+     */
+    safeSorting: (userSortColumn, userDirection) => {
+        const allowedColumns = ['name', 'email', 'created_at', 'updated_at'];
+        if (!allowedColumns.includes(userSortColumn)) {
+            throw new Error('Invalid sort column');
+        }
+        return {
+            column: sql_js_1.sql.ref(userSortColumn),
+            direction: safeOrderDirection(userDirection),
+        };
+    },
+    /**
+     * Example: Safe lock mode for transactions
+     */
+    safeTransactionLock: () => {
+        return safeLockMode('FOR_UPDATE');
+    },
+};
+/**
+ * Helper to validate that a value is from a specific enum
+ */
+function validateEnum(value, enumValues, fieldName = 'value') {
+    if (!enumValues.includes(value)) {
+        throw new Error(`Invalid ${fieldName}: "${value}". Allowed values: ${enumValues.join(', ')}`);
+    }
+    return value;
+}
+/**
+ * Helper to validate numeric ranges
+ */
+function validateNumericRange(value, min, max, fieldName = 'value') {
+    const num = typeof value === 'string' ? parseFloat(value) : value;
+    if (isNaN(num)) {
+        throw new Error(`Invalid ${fieldName}: "${value}". Must be a number`);
+    }
+    if (num < min || num > max) {
+        throw new Error(`Invalid ${fieldName}: ${num}. Must be between ${min} and ${max}`);
+    }
+    return num;
+}

package/dist/cjs/util/security-validator.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Security validation utilities for NOORMME
+ * Provides input validation and sanitization to prevent injection attacks
+ */
+/**
+ * Validates identifier names (table names, column names, schema names)
+ * to prevent SQL injection through dynamic identifiers
+ */
+export declare function validateIdentifier(identifier: string, context?: string): void;
+/**
+ * Validates table reference for dynamic table operations
+ */
+export declare function validateTableReference(tableRef: string): void;
+/**
+ * Validates column reference for dynamic column operations
+ */
+export declare function validateColumnReference(columnRef: string): void;
+/**
+ * Validates file paths to prevent path traversal attacks
+ */
+export declare function validateFilePath(filePath: string, allowedExtensions?: string[]): void;
+/**
+ * Sanitizes database path for CLI commands
+ */
+export declare function sanitizeDatabasePath(dbPath: string): string;
+/**
+ * Validates output directory for code generation
+ */
+export declare function validateOutputDirectory(dirPath: string): void;
+/**
+ * Validates migration name
+ */
+export declare function validateMigrationName(name: string): void;
+/**
+ * Rate limiting for security-sensitive operations
+ */
+export declare class RateLimiter {
+    private maxAttempts;
+    private windowMs;
+    private attempts;
+    constructor(maxAttempts?: number, windowMs?: number);
+    checkLimit(key: string): void;
+    private cleanup;
+}

package/dist/cjs/util/security-validator.js

@@ -0,0 +1,256 @@
+"use strict";
+/**
+ * Security validation utilities for NOORMME
+ * Provides input validation and sanitization to prevent injection attacks
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RateLimiter = void 0;
+exports.validateIdentifier = validateIdentifier;
+exports.validateTableReference = validateTableReference;
+exports.validateColumnReference = validateColumnReference;
+exports.validateFilePath = validateFilePath;
+exports.sanitizeDatabasePath = sanitizeDatabasePath;
+exports.validateOutputDirectory = validateOutputDirectory;
+exports.validateMigrationName = validateMigrationName;
+/**
+ * Validates identifier names (table names, column names, schema names)
+ * to prevent SQL injection through dynamic identifiers
+ */
+function validateIdentifier(identifier, context = 'identifier') {
+    if (typeof identifier !== 'string') {
+        throw new Error(`${context} must be a string`);
+    }
+    if (identifier.length === 0) {
+        throw new Error(`${context} cannot be empty`);
+    }
+    if (identifier.length > 255) {
+        throw new Error(`${context} exceeds maximum length of 255 characters`);
+    }
+    // Check for SQL injection patterns
+    const dangerousPatterns = [
+        /;/, // SQL statement separator
+        /--/, // SQL comment
+        /\/\*/, // Multi-line comment start
+        /\*\//, // Multi-line comment end
+        /\bUNION\b/i, // UNION injection
+        /\bSELECT\b.*\bFROM\b/i, // SELECT injection
+        /\bINSERT\b.*\bINTO\b/i, // INSERT injection
+        /\bUPDATE\b.*\bSET\b/i, // UPDATE injection
+        /\bDELETE\b.*\bFROM\b/i, // DELETE injection
+        /\bDROP\b/i, // DROP injection
+        /\bEXEC\b/i, // EXEC injection
+        /\bEXECUTE\b/i, // EXECUTE injection
+        /\bCREATE\b/i, // CREATE injection
+        /\bALTER\b/i, // ALTER injection
+        /\bTRUNCATE\b/i, // TRUNCATE injection
+        /['"`]/, // Quote characters
+        /\\/, // Backslash escape
+        /\x00/, // Null byte
+    ];
+    for (const pattern of dangerousPatterns) {
+        if (pattern.test(identifier)) {
+            throw new Error(`Invalid ${context}: "${identifier}" contains potentially dangerous characters or SQL keywords. ` +
+                `Identifiers must contain only alphanumeric characters, underscores, and dots (for schema.table references).`);
+        }
+    }
+    // Validate format: alphanumeric, underscore, and dots for schema.table.column
+    const validIdentifierPattern = /^[a-zA-Z_][a-zA-Z0-9_]*(\.[a-zA-Z_][a-zA-Z0-9_]*)*$/;
+    if (!validIdentifierPattern.test(identifier)) {
+        throw new Error(`Invalid ${context}: "${identifier}". ` +
+            `Identifiers must start with a letter or underscore, followed by alphanumeric characters or underscores. ` +
+            `Schema/table references can use dots (e.g., "schema.table" or "table.column").`);
+    }
+    // Additional check: prevent reserved SQLite keywords that could be dangerous
+    const reservedKeywords = [
+        'PRAGMA', 'ATTACH', 'DETACH', 'VACUUM', 'ANALYZE', 'REINDEX'
+    ];
+    for (const keyword of reservedKeywords) {
+        if (identifier.toUpperCase() === keyword) {
+            throw new Error(`Invalid ${context}: "${identifier}" is a reserved SQLite keyword and cannot be used as an identifier`);
+        }
+    }
+}
+/**
+ * Validates table reference for dynamic table operations
+ */
+function validateTableReference(tableRef) {
+    validateIdentifier(tableRef, 'table reference');
+    // Additional validation for table references
+    const parts = tableRef.split('.');
+    if (parts.length > 2) {
+        throw new Error(`Invalid table reference: "${tableRef}". ` +
+            `Table references can have at most 2 parts (schema.table).`);
+    }
+    // Validate each part
+    parts.forEach((part, index) => {
+        const context = index === 0 ? (parts.length === 2 ? 'schema name' : 'table name') : 'table name';
+        validateIdentifier(part, context);
+    });
+}
+/**
+ * Validates column reference for dynamic column operations
+ */
+function validateColumnReference(columnRef) {
+    validateIdentifier(columnRef, 'column reference');
+    // Column references can have: column, table.column, or schema.table.column
+    const parts = columnRef.split('.');
+    if (parts.length > 3) {
+        throw new Error(`Invalid column reference: "${columnRef}". ` +
+            `Column references can have at most 3 parts (schema.table.column).`);
+    }
+    // Validate each part
+    parts.forEach((part, index) => {
+        let context;
+        if (parts.length === 1) {
+            context = 'column name';
+        }
+        else if (parts.length === 2) {
+            context = index === 0 ? 'table name' : 'column name';
+        }
+        else {
+            context = index === 0 ? 'schema name' : (index === 1 ? 'table name' : 'column name');
+        }
+        validateIdentifier(part, context);
+    });
+}
+/**
+ * Validates file paths to prevent path traversal attacks
+ */
+function validateFilePath(filePath, allowedExtensions) {
+    if (typeof filePath !== 'string') {
+        throw new Error('File path must be a string');
+    }
+    if (filePath.length === 0) {
+        throw new Error('File path cannot be empty');
+    }
+    // Check for path traversal patterns
+    const pathTraversalPatterns = [
+        /\.\./, // Parent directory reference
+        /~\//, // Home directory reference
+        /^\/+/, // Absolute path (starts with /)
+        /^[a-zA-Z]:\\/, // Windows absolute path (C:\)
+        /\\/, // Backslash (Windows path separator)
+        /\x00/, // Null byte injection
+    ];
+    for (const pattern of pathTraversalPatterns) {
+        if (pattern.test(filePath)) {
+            throw new Error(`Invalid file path: "${filePath}" contains path traversal or absolute path patterns. ` +
+                `Only relative paths within the current directory are allowed.`);
+        }
+    }
+    // Validate file extension if specified
+    if (allowedExtensions && allowedExtensions.length > 0) {
+        const hasValidExtension = allowedExtensions.some(ext => filePath.toLowerCase().endsWith(ext.toLowerCase()));
+        if (!hasValidExtension) {
+            throw new Error(`Invalid file extension for "${filePath}". ` +
+                `Allowed extensions: ${allowedExtensions.join(', ')}`);
+        }
+    }
+    // Check for suspicious file names
+    const suspiciousNames = [
+        /^\.+$/, // Only dots
+        /^\s*$/, // Only whitespace
+        /[<>:"|?*]/, // Windows forbidden characters
+    ];
+    for (const pattern of suspiciousNames) {
+        if (pattern.test(filePath)) {
+            throw new Error(`Invalid file path: "${filePath}" contains forbidden characters or is malformed`);
+        }
+    }
+}
+/**
+ * Sanitizes database path for CLI commands
+ */
+function sanitizeDatabasePath(dbPath) {
+    validateFilePath(dbPath, ['.db', '.sqlite', '.sqlite3', '.db3']);
+    // Ensure the path doesn't escape current directory
+    if (dbPath.includes('..') || dbPath.startsWith('/') || /^[a-zA-Z]:/.test(dbPath)) {
+        throw new Error(`Database path "${dbPath}" must be a relative path within the current directory`);
+    }
+    return dbPath;
+}
+/**
+ * Validates output directory for code generation
+ */
+function validateOutputDirectory(dirPath) {
+    if (typeof dirPath !== 'string') {
+        throw new Error('Output directory must be a string');
+    }
+    if (dirPath.length === 0) {
+        throw new Error('Output directory cannot be empty');
+    }
+    // Prevent path traversal
+    if (dirPath.includes('..')) {
+        throw new Error(`Output directory "${dirPath}" cannot contain parent directory references (..)`);
+    }
+    // Prevent absolute paths
+    if (dirPath.startsWith('/') || /^[a-zA-Z]:/.test(dirPath)) {
+        throw new Error(`Output directory "${dirPath}" must be a relative path`);
+    }
+    // Validate format
+    const validDirPattern = /^[a-zA-Z0-9_\-./]+$/;
+    if (!validDirPattern.test(dirPath)) {
+        throw new Error(`Invalid output directory: "${dirPath}". ` +
+            `Directory paths must contain only alphanumeric characters, underscores, hyphens, dots, and forward slashes.`);
+    }
+}
+/**
+ * Validates migration name
+ */
+function validateMigrationName(name) {
+    if (typeof name !== 'string') {
+        throw new Error('Migration name must be a string');
+    }
+    if (name.length === 0) {
+        throw new Error('Migration name cannot be empty');
+    }
+    if (name.length > 100) {
+        throw new Error('Migration name exceeds maximum length of 100 characters');
+    }
+    // Allow only alphanumeric, underscores, and hyphens
+    const validNamePattern = /^[a-zA-Z0-9_\-]+$/;
+    if (!validNamePattern.test(name)) {
+        throw new Error(`Invalid migration name: "${name}". ` +
+            `Migration names must contain only alphanumeric characters, underscores, and hyphens.`);
+    }
+}
+/**
+ * Rate limiting for security-sensitive operations
+ */
+class RateLimiter {
+    maxAttempts;
+    windowMs;
+    attempts = new Map();
+    constructor(maxAttempts = 10, windowMs = 60000 // 1 minute
+    ) {
+        this.maxAttempts = maxAttempts;
+        this.windowMs = windowMs;
+    }
+    checkLimit(key) {
+        const now = Date.now();
+        const attempts = this.attempts.get(key) || [];
+        // Remove old attempts outside the window
+        const recentAttempts = attempts.filter(time => now - time < this.windowMs);
+        if (recentAttempts.length >= this.maxAttempts) {
+            throw new Error(`Rate limit exceeded for ${key}. Please wait before trying again.`);
+        }
+        recentAttempts.push(now);
+        this.attempts.set(key, recentAttempts);
+        // Cleanup old entries periodically
+        if (this.attempts.size > 1000) {
+            this.cleanup(now);
+        }
+    }
+    cleanup(now) {
+        for (const [key, attempts] of this.attempts.entries()) {
+            const recentAttempts = attempts.filter(time => now - time < this.windowMs);
+            if (recentAttempts.length === 0) {
+                this.attempts.delete(key);
+            }
+            else {
+                this.attempts.set(key, recentAttempts);
+            }
+        }
+    }
+}
+exports.RateLimiter = RateLimiter;

package/dist/cjs/util/security.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Security utilities for NOORMME
+ * Export all security-related functions for easy import
+ */
+export { validateIdentifier, validateTableReference, validateColumnReference, validateFilePath, sanitizeDatabasePath, validateOutputDirectory, validateMigrationName, RateLimiter, } from './security-validator.js';
+export { safeOrderDirection, safeLimit, safeOffset, safeKeyword, safeLockMode, safeOrderBy, safeBoolean, safeCaseStatement, SafeSQLKeywords, SafeSQLExamples, validateEnum, validateNumericRange, type SafeOrderBy, type SafeCaseWhen, } from './safe-sql-helpers.js';
+/**
+ * Security best practices and guidelines
+ */
+export declare const SecurityGuidelines: {
+    /**
+     * NEVER use sql.raw() or sql.lit() with user input
+     */
+    readonly NEVER_USE_RAW_WITH_USER_INPUT: "Use safe alternatives or parameterized queries";
+    /**
+     * ALWAYS validate dynamic identifiers
+     */
+    readonly ALWAYS_VALIDATE_IDENTIFIERS: "Use validateColumnReference() or validateTableReference()";
+    /**
+     * ALWAYS use whitelists for user-controlled values
+     */
+    readonly ALWAYS_USE_WHITELISTS: "Define allowed values and validate against them";
+    /**
+     * ALWAYS sanitize file paths
+     */
+    readonly ALWAYS_SANITIZE_PATHS: "Use validateFilePath() or sanitizeDatabasePath()";
+    /**
+     * PREFER parameterized queries
+     */
+    readonly PREFER_PARAMETERIZED_QUERIES: "Use sql`${value}` instead of sql.raw()";
+    /**
+     * PREFER safe helpers over raw SQL
+     */
+    readonly PREFER_SAFE_HELPERS: "Use safeOrderDirection(), safeLimit(), etc.";
+};
+/**
+ * Quick security checklist for developers
+ */
+export declare function securityChecklist(): string;
+/**
+ * Common security patterns
+ */
+export declare const SecurityPatterns: {
+    /**
+     * Safe column selection from user input
+     */
+    safeColumnSelection: (userColumn: string, allowedColumns: string[]) => string;
+    /**
+     * Safe table selection from user input
+     */
+    safeTableSelection: (userTable: string, allowedTables: string[]) => string;
+    /**
+     * Safe enum validation
+     */
+    safeEnumValue: <T extends string>(value: string, allowedValues: readonly T[]) => T;
+    /**
+     * Safe numeric range validation
+     */
+    safeNumericValue: (value: number | string, min: number, max: number) => number;
+};