noormme 1.0.0 → 1.0.2

package/dist/esm/performance/utils/query-parser.js

@@ -0,0 +1,292 @@
+/// <reference types="./query-parser.d.ts" />
+/**
+ * Query parsing utilities for performance analysis and optimization
+ */
+/**
+ * Utility class for parsing and analyzing SQL queries
+ */
+export class QueryParser {
+    /**
+     * Parse a SQL query into structured components
+     */
+    static parseQuery(query) {
+        const normalized = this.normalizeQuery(query);
+        const lowerQuery = normalized.toLowerCase();
+        return {
+            type: this.extractQueryType(normalized),
+            tables: this.extractTables(normalized),
+            whereColumns: this.extractWhereColumns(normalized),
+            joinColumns: this.extractJoinColumns(normalized),
+            orderByColumns: this.extractOrderByColumns(normalized),
+            groupByColumns: this.extractGroupByColumns(normalized),
+            hasLimit: lowerQuery.includes('limit'),
+            hasAggregates: this.hasAggregates(normalized),
+            isComplex: this.isComplexQuery(normalized)
+        };
+    }
+    /**
+     * Normalize query for comparison (remove dynamic values)
+     */
+    static normalizeQuery(query) {
+        return query
+            .replace(/\$\d+/g, '?') // Replace PostgreSQL parameters
+            .replace(/'[^']*'/g, '?') // Replace string literals
+            .replace(/\b\d+\b/g, '?') // Replace numbers
+            .replace(/\s+/g, ' ') // Normalize whitespace
+            .trim();
+    }
+    /**
+     * Extract query type from SQL statement
+     */
+    static extractQueryType(query) {
+        const normalized = query.trim().toUpperCase();
+        if (normalized.startsWith('SELECT'))
+            return 'SELECT';
+        if (normalized.startsWith('INSERT'))
+            return 'INSERT';
+        if (normalized.startsWith('UPDATE'))
+            return 'UPDATE';
+        if (normalized.startsWith('DELETE'))
+            return 'DELETE';
+        return 'OTHER';
+    }
+    /**
+     * Extract table names from query
+     */
+    static extractTables(query) {
+        const tables = new Set();
+        // FROM clause
+        const fromMatches = query.match(/from\s+(\w+)/gi);
+        if (fromMatches) {
+            fromMatches.forEach(match => {
+                const table = match.split(/\s+/)[1];
+                if (table)
+                    tables.add(table);
+            });
+        }
+        // JOIN clauses
+        const joinMatches = query.match(/join\s+(\w+)/gi);
+        if (joinMatches) {
+            joinMatches.forEach(match => {
+                const table = match.split(/\s+/)[1];
+                if (table)
+                    tables.add(table);
+            });
+        }
+        return Array.from(tables);
+    }
+    /**
+     * Extract columns used in WHERE clauses
+     */
+    static extractWhereColumns(query) {
+        const whereMatch = query.match(/where\s+(.+?)(?:\s+group\s+by|\s+order\s+by|\s+limit|$)/i);
+        if (!whereMatch)
+            return [];
+        const whereClause = whereMatch[1];
+        const columnMatches = whereClause.match(/(\w+)\s*[=<>!]/g);
+        return columnMatches
+            ? columnMatches.map(match => match.split(/\s+/)[0]).filter(Boolean)
+            : [];
+    }
+    /**
+     * Extract columns used in JOIN conditions
+     */
+    static extractJoinColumns(query) {
+        const joinMatches = query.match(/join\s+\w+\s+on\s+(\w+)\.(\w+)\s*=\s*(\w+)\.(\w+)/gi);
+        if (!joinMatches)
+            return [];
+        const columns = [];
+        for (const match of joinMatches) {
+            const parts = match.match(/join\s+(\w+)\s+on\s+(\w+)\.(\w+)\s*=\s*(\w+)\.(\w+)/i);
+            if (parts) {
+                columns.push({ table: parts[2], column: parts[3] });
+                columns.push({ table: parts[4], column: parts[5] });
+            }
+        }
+        return columns;
+    }
+    /**
+     * Extract columns used in ORDER BY clauses
+     */
+    static extractOrderByColumns(query) {
+        const orderByMatch = query.match(/order\s+by\s+(.+?)(?:\s+limit|$)/i);
+        if (!orderByMatch)
+            return [];
+        return orderByMatch[1]
+            .split(',')
+            .map(col => col.trim().split(/\s+/)[0])
+            .filter(Boolean);
+    }
+    /**
+     * Extract columns used in GROUP BY clauses
+     */
+    static extractGroupByColumns(query) {
+        const groupByMatch = query.match(/group\s+by\s+(.+?)(?:\s+having|\s+order\s+by|\s+limit|$)/i);
+        if (!groupByMatch)
+            return [];
+        return groupByMatch[1]
+            .split(',')
+            .map(col => col.trim())
+            .filter(Boolean);
+    }
+    /**
+     * Check if query contains aggregate functions
+     */
+    static hasAggregates(query) {
+        const lowerQuery = query.toLowerCase();
+        return lowerQuery.includes('group by') ||
+            lowerQuery.includes('having') ||
+            lowerQuery.includes('count(') ||
+            lowerQuery.includes('sum(') ||
+            lowerQuery.includes('avg(') ||
+            lowerQuery.includes('max(') ||
+            lowerQuery.includes('min(');
+    }
+    /**
+     * Check if query is complex (joins, subqueries, etc.)
+     */
+    static isComplexQuery(query) {
+        const lowerQuery = query.toLowerCase();
+        return lowerQuery.includes('join') ||
+            lowerQuery.includes('subquery') ||
+            lowerQuery.includes('union') ||
+            lowerQuery.includes('except') ||
+            lowerQuery.includes('intersect') ||
+            (lowerQuery.includes('select') && lowerQuery.includes('('));
+    }
+    /**
+     * Check if query could return many rows
+     */
+    static couldReturnManyRows(query) {
+        const lowerQuery = query.toLowerCase();
+        return lowerQuery.includes('where') && !lowerQuery.includes('limit');
+    }
+    /**
+     * Extract the primary table from a query
+     */
+    static extractPrimaryTable(query) {
+        const fromMatch = query.match(/from\s+(\w+)/i);
+        return fromMatch ? fromMatch[1] : null;
+    }
+    /**
+     * Check if query is a SELECT statement
+     */
+    static isSelectQuery(query) {
+        return query.toLowerCase().trim().startsWith('select');
+    }
+    /**
+     * Check if query is a JOIN statement
+     */
+    static isJoinQuery(query) {
+        return query.toLowerCase().includes('join');
+    }
+    /**
+     * Check if query is an aggregate statement
+     */
+    static isAggregateQuery(query) {
+        return this.hasAggregates(query);
+    }
+    /**
+     * Generate a cache key for a query
+     */
+    static generateCacheKey(query, params = []) {
+        const normalized = this.normalizeQuery(query);
+        const paramsKey = params.map(p => String(p)).join('|');
+        return `${normalized}:${paramsKey}`;
+    }
+    /**
+     * Check if query should be cached
+     */
+    static shouldCache(query, executionTime) {
+        // Don't cache very fast queries
+        if (executionTime < 10) {
+            return false;
+        }
+        // Don't cache queries that modify data
+        const lowerQuery = query.toLowerCase();
+        if (lowerQuery.includes('insert') ||
+            lowerQuery.includes('update') ||
+            lowerQuery.includes('delete') ||
+            lowerQuery.includes('drop')) {
+            return false;
+        }
+        return true;
+    }
+    /**
+     * Extract operation type from query
+     */
+    static extractOperation(query) {
+        return this.extractQueryType(query);
+    }
+    /**
+     * Analyze query patterns from a list of queries
+     */
+    static analyzePatterns(queries) {
+        const patternMap = new Map();
+        for (const { query, executionTime } of queries) {
+            const normalized = this.normalizeQuery(query);
+            if (patternMap.has(normalized)) {
+                const pattern = patternMap.get(normalized);
+                pattern.frequency++;
+                pattern.averageTime = (pattern.averageTime + executionTime) / 2;
+            }
+            else {
+                const parsed = this.parseQuery(query);
+                patternMap.set(normalized, {
+                    normalized,
+                    original: query,
+                    frequency: 1,
+                    averageTime: executionTime,
+                    tables: parsed.tables
+                });
+            }
+        }
+        return Array.from(patternMap.values())
+            .sort((a, b) => b.frequency - a.frequency);
+    }
+    /**
+     * Detect potential N+1 query patterns
+     */
+    static detectNPlusOnePatterns(queries) {
+        const patterns = new Map();
+        // Group queries by normalized pattern
+        for (const queryInfo of queries) {
+            const normalized = this.normalizeQuery(queryInfo.query);
+            if (!patterns.has(normalized)) {
+                patterns.set(normalized, []);
+            }
+            patterns.get(normalized).push(queryInfo);
+        }
+        const nPlusOnePatterns = [];
+        // Analyze each pattern for N+1 behavior
+        for (const [pattern, queries] of patterns.entries()) {
+            if (queries.length < 5)
+                continue; // Need at least 5 occurrences
+            // Check for clustering in time windows
+            const timeWindows = [5000, 10000, 30000]; // 5s, 10s, 30s
+            for (const windowMs of timeWindows) {
+                let maxCountInWindow = 0;
+                for (const query of queries) {
+                    const windowStart = query.timestamp - windowMs;
+                    const countInWindow = queries.filter(q => q.timestamp >= windowStart && q.timestamp <= query.timestamp).length;
+                    maxCountInWindow = Math.max(maxCountInWindow, countInWindow);
+                }
+                if (maxCountInWindow >= 5) {
+                    let severity = 'low';
+                    if (maxCountInWindow >= 20)
+                        severity = 'high';
+                    else if (maxCountInWindow >= 10)
+                        severity = 'medium';
+                    nPlusOnePatterns.push({
+                        pattern,
+                        count: maxCountInWindow,
+                        timeWindow: windowMs,
+                        severity
+                    });
+                    break; // Only report the most severe pattern
+                }
+            }
+        }
+        return nPlusOnePatterns.sort((a, b) => b.count - a.count);
+    }
+}

package/dist/esm/raw-builder/sql.d.ts

@@ -136,6 +136,9 @@ export interface Sql {
      * WARNING! Using this with unchecked inputs WILL lead to SQL injection
      * vulnerabilities. The input is not checked or escaped by Kysely in any way.
      *
+     * SECURITY: This method now includes built-in validation to prevent SQL injection.
+     * You should still validate that references come from trusted sources or a whitelist.
+     *
      * ```ts
      * const columnRef = 'first_name'
      *
@@ -184,8 +187,9 @@ export interface Sql {
      * transformed into parameters. You can use this function to tell
      * Kysely to interpret them as table references instead.
      *
-     * WARNING! Using this with unchecked inputs WILL lead to SQL injection
-     * vulnerabilities. The input is not checked or escaped by Kysely in any way.
+     * SECURITY: This method validates all inputs to prevent SQL injection.
+     * You should still ensure table names come from trusted sources or use
+     * a whitelist approach for additional safety.
      *
      * ```ts
      * const table = 'person'
@@ -224,13 +228,13 @@ export interface Sql {
      * instead of this whenever possible as they produce a more semantic
      * operation node tree.
      *
-     * WARNING! Using this with unchecked inputs WILL lead to SQL injection
-     * vulnerabilities. The input is not checked or escaped by Kysely in any way.
+     * SECURITY: This method validates all identifiers to prevent SQL injection.
+     * Each identifier is checked for dangerous patterns before use.
      *
      * ```ts
      * const indexName = 'person_first_name_index'
      *
-     * sql`create index ${indexName} on person`
+     * sql`create index ${sql.id(indexName)} on person`
      * ```
      *
      * The generated SQL (PostgreSQL):
@@ -259,21 +263,33 @@ export interface Sql {
     /**
      * This can be used to add literal values to SQL snippets.
      *
-     * WARNING! Using this with unchecked inputs WILL lead to SQL injection
-     * vulnerabilities. The input is not checked or escaped by Kysely in any way.
-     * You almost always want to use normal substitutions that get sent to the
-     * db as parameters.
+     * @deprecated EXTREMELY DANGEROUS - This method bypasses all SQL injection protections.
+     * Use parameterized queries instead (normal ${} substitutions).
      *
-     * ```ts
-     * const firstName = 'first_name'
+     * ⚠️ CRITICAL SECURITY WARNING: This method is UNSAFE and should ONLY be used with
+     * trusted, hardcoded values. It does NOT escape or validate input. Using this with
+     * user input WILL lead to SQL injection vulnerabilities.
      *
-     * sql`select * from person where first_name = ${sql.lit(firstName)}`
-     * ```
+     * 🚨 SECURITY POLICY: This method is marked as LEGACY and DANGEROUS.
+     * - NEVER use with user input or any untrusted data
+     * - NEVER use with dynamically constructed strings
+     * - ONLY use with compile-time constants if absolutely necessary
      *
-     * The generated SQL (PostgreSQL):
+     * You almost ALWAYS want to use normal substitutions (parameterized queries)
+     * instead of this method. Use this ONLY when something absolutely cannot be
+     * sent as a parameter.
      *
-     * ```sql
-     * select * from person where first_name = 'first_name'
+     * ```ts
+     * // ❌ NEVER do this with user input:
+     * const userInput = req.body.value
+     * sql`select * from person where name = ${sql.lit(userInput)}`  // VULNERABLE!
+     *
+     * // ✅ Use parameterized queries instead:
+     * const userInput = req.body.value
+     * sql`select * from person where name = ${userInput}`  // Safe - parameterized
+     *
+     * // ✅ Only use lit() for hardcoded constants:
+     * sql`select * from person where status = ${sql.lit('active')}`  // Safe
      * ```
      *
      * As you can see from the example above, the value was added directly to
@@ -288,24 +304,55 @@ export interface Sql {
     /**
      * This can be used to add arbitrary runtime SQL to SQL snippets.
      *
-     * WARNING! Using this with unchecked inputs WILL lead to SQL injection
-     * vulnerabilities. The input is not checked or escaped by Kysely in any way.
+     * @deprecated CATASTROPHICALLY DANGEROUS - This method completely bypasses all security.
+     * Use safe alternatives from 'noormme/util/safe-sql-helpers' instead.
      *
-     * ```ts
-     * const firstName = "'first_name'"
+     * 🚨 CRITICAL SECURITY WARNING: This method is EXTREMELY UNSAFE and should NEVER be
+     * used with any user input. It does NOT escape, validate, or sanitize input.
+     * The input is directly concatenated into the SQL string.
      *
-     * sql`select * from person where first_name = ${sql.raw(firstName)}`
-     * ```
+     * Using this with user input WILL lead to SQL injection vulnerabilities.
      *
-     * The generated SQL (PostgreSQL):
+     * 🚨 SECURITY POLICY: This method is marked as LEGACY and EXTREMELY DANGEROUS.
+     * - NEVER use with user input or any untrusted data
+     * - NEVER use with data from external sources (requests, files, etc.)
+     * - NEVER use with dynamically constructed strings
+     * - Use safe alternatives instead: safeOrderDirection(), safeLimit(), etc.
      *
-     * ```sql
-     * select * from person where first_name = 'first_name'
+     * This method should ONLY be used for:
+     * - Hardcoded SQL fragments (compile-time constants only)
+     * - SQL generated by other trusted parts of your application
+     * - Database-specific syntax that cannot be expressed otherwise
+     *
+     * ✅ RECOMMENDED ALTERNATIVES:
+     * - For order direction: use safeOrderDirection() from 'noormme/util/safe-sql-helpers'
+     * - For limits/offsets: use safeLimit() or safeOffset()
+     * - For keywords: use safeKeyword() with a whitelist
+     * - For identifiers: use sql.ref(), sql.table(), or sql.id() (they're validated)
+     *
+     * ```ts
+     * // ❌ NEVER EVER do this:
+     * const userInput = req.body.sql
+     * sql`${sql.raw(userInput)}`  // CATASTROPHIC VULNERABILITY!
+     *
+     * // ✅ Use safe alternatives instead:
+     * import { safeOrderDirection } from 'noormme/util/safe-sql-helpers'
+     * const direction = req.query.dir
+     * sql`select * from person order by name ${safeOrderDirection(direction)}`
+     *
+     * // ✅ Only use raw() with hardcoded SQL:
+     * sql`select * from person ${sql.raw('FOR UPDATE')}`  // Safe - hardcoded
      * ```
      *
      * Note that the difference to `sql.lit` is that this function
      * doesn't assume the inputs are values. The input to this function
-     * can be any sql and it's simply glued to the parent string as-is.
+     * can be any SQL and it's simply glued to the parent string as-is.
+     *
+     * If you're considering using this method, ask yourself:
+     * - Can I use a parameterized query instead?
+     * - Can I use sql.ref(), sql.table(), or sql.id() instead? (They're validated!)
+     * - Can I use a safe helper from 'noormme/util/safe-sql-helpers'?
+     * - Is this input from a 100% trusted, hardcoded source?
      */
     raw<R = unknown>(anySql: string): RawBuilder<R>;
     /**

package/dist/esm/raw-builder/sql.js

@@ -8,6 +8,7 @@ import { parseTable } from '../parser/table-parser.js';
 import { parseValueExpression } from '../parser/value-parser.js';
 import { createQueryId } from '../util/query-id.js';
 import { createRawBuilder } from './raw-builder.js';
+import { validateColumnReference, validateTableReference, validateIdentifier } from '../util/security-validator.js';
 export const sql = Object.assign((sqlFragments, ...parameters) => {
     return createRawBuilder({
         queryId: createQueryId(),
@@ -15,6 +16,8 @@ export const sql = Object.assign((sqlFragments, ...parameters) => {
     });
 }, {
     ref(columnReference) {
+        // Security validation to prevent SQL injection
+        validateColumnReference(columnReference);
         return createRawBuilder({
             queryId: createQueryId(),
             rawNode: RawNode.createWithChild(parseStringReference(columnReference)),
@@ -30,12 +33,18 @@ export const sql = Object.assign((sqlFragments, ...parameters) => {
         return this.val(value);
     },
     table(tableReference) {
+        // Security validation to prevent SQL injection
+        validateTableReference(tableReference);
         return createRawBuilder({
             queryId: createQueryId(),
             rawNode: RawNode.createWithChild(parseTable(tableReference)),
         });
     },
     id(...ids) {
+        // Security validation for each identifier
+        ids.forEach((id, index) => {
+            validateIdentifier(id, `identifier[${index}]`);
+        });
         const fragments = new Array(ids.length + 1).fill('.');
         fragments[0] = '';
         fragments[fragments.length - 1] = '';

package/dist/esm/repository/repository-factory.d.ts

@@ -1,54 +1,22 @@
 import type { Kysely } from '../kysely.js';
-import { TableInfo, RelationshipInfo, Repository, PerformanceConfig } from '../types';
+import type { Repository, TableInfo, RelationshipInfo } from '../types/index.js';
 /**
- * Repository factory that creates dynamic repository classes
+ * Simple repository factory for creating table repositories
  */
 export declare class RepositoryFactory {
     private db;
-    private config;
-    constructor(db: Kysely<any>, config?: PerformanceConfig);
+    private performanceConfig?;
+    constructor(db: Kysely<any>, performanceConfig?: any | undefined);
     /**
-     * Create a repository for the specified table
-     */
-    createRepository<T>(table: TableInfo, relationships: RelationshipInfo[]): Repository<T>;
-    /**
-     * Add custom finder methods to repository
-     */
-    private addCustomFinders;
-    /**
-     * Load relationships for entities
-     */
-    private loadRelationships;
-    /**
-     * Load relationships for a single entity
-     */
-    private loadEntityRelationships;
-    /**
-     * Batch load relationships for multiple entities
+     * Transform boolean columns from SQLite integers (0/1) to JavaScript booleans
      */
-    private batchLoadRelationships;
+    private transformBooleans;
     /**
-     * Load a single relationship for an entity
-     */
-    private loadSingleRelationship;
-    /**
-     * Batch load a single relationship for multiple entities
-     */
-    private batchLoadSingleRelationship;
-    /**
-     * Get primary key condition for queries
-     */
-    private getPrimaryKeyCondition;
-    /**
-     * Get primary key value from entity
-     */
-    private getPrimaryKeyValue;
-    /**
-     * Get update data (exclude primary key)
+     * Create a repository for the specified table
      */
-    private getUpdateData;
+    createRepository<T>(table: TableInfo, relationships: RelationshipInfo[]): Repository<T>;
     /**
-     * Convert string to PascalCase
+     * Wrap repository with Proxy to handle dynamic method calls
      */
-    private toPascalCase;
+    private wrapWithDynamicMethods;
 }