noormme 1.0.0 → 1.0.2

package/dist/esm/util/security-validator.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Security validation utilities for NOORMME
+ * Provides input validation and sanitization to prevent injection attacks
+ */
+/**
+ * Validates identifier names (table names, column names, schema names)
+ * to prevent SQL injection through dynamic identifiers
+ */
+export declare function validateIdentifier(identifier: string, context?: string): void;
+/**
+ * Validates table reference for dynamic table operations
+ */
+export declare function validateTableReference(tableRef: string): void;
+/**
+ * Validates column reference for dynamic column operations
+ */
+export declare function validateColumnReference(columnRef: string): void;
+/**
+ * Validates file paths to prevent path traversal attacks
+ */
+export declare function validateFilePath(filePath: string, allowedExtensions?: string[]): void;
+/**
+ * Sanitizes database path for CLI commands
+ */
+export declare function sanitizeDatabasePath(dbPath: string): string;
+/**
+ * Validates output directory for code generation
+ */
+export declare function validateOutputDirectory(dirPath: string): void;
+/**
+ * Validates migration name
+ */
+export declare function validateMigrationName(name: string): void;
+/**
+ * Rate limiting for security-sensitive operations
+ */
+export declare class RateLimiter {
+    private maxAttempts;
+    private windowMs;
+    private attempts;
+    constructor(maxAttempts?: number, windowMs?: number);
+    checkLimit(key: string): void;
+    private cleanup;
+}

package/dist/esm/util/security-validator.js

@@ -0,0 +1,246 @@
+/// <reference types="./security-validator.d.ts" />
+/**
+ * Security validation utilities for NOORMME
+ * Provides input validation and sanitization to prevent injection attacks
+ */
+/**
+ * Validates identifier names (table names, column names, schema names)
+ * to prevent SQL injection through dynamic identifiers
+ */
+export function validateIdentifier(identifier, context = 'identifier') {
+    if (typeof identifier !== 'string') {
+        throw new Error(`${context} must be a string`);
+    }
+    if (identifier.length === 0) {
+        throw new Error(`${context} cannot be empty`);
+    }
+    if (identifier.length > 255) {
+        throw new Error(`${context} exceeds maximum length of 255 characters`);
+    }
+    // Check for SQL injection patterns
+    const dangerousPatterns = [
+        /;/, // SQL statement separator
+        /--/, // SQL comment
+        /\/\*/, // Multi-line comment start
+        /\*\//, // Multi-line comment end
+        /\bUNION\b/i, // UNION injection
+        /\bSELECT\b.*\bFROM\b/i, // SELECT injection
+        /\bINSERT\b.*\bINTO\b/i, // INSERT injection
+        /\bUPDATE\b.*\bSET\b/i, // UPDATE injection
+        /\bDELETE\b.*\bFROM\b/i, // DELETE injection
+        /\bDROP\b/i, // DROP injection
+        /\bEXEC\b/i, // EXEC injection
+        /\bEXECUTE\b/i, // EXECUTE injection
+        /\bCREATE\b/i, // CREATE injection
+        /\bALTER\b/i, // ALTER injection
+        /\bTRUNCATE\b/i, // TRUNCATE injection
+        /['"`]/, // Quote characters
+        /\\/, // Backslash escape
+        /\x00/, // Null byte
+    ];
+    for (const pattern of dangerousPatterns) {
+        if (pattern.test(identifier)) {
+            throw new Error(`Invalid ${context}: "${identifier}" contains potentially dangerous characters or SQL keywords. ` +
+                `Identifiers must contain only alphanumeric characters, underscores, and dots (for schema.table references).`);
+        }
+    }
+    // Validate format: alphanumeric, underscore, and dots for schema.table.column
+    const validIdentifierPattern = /^[a-zA-Z_][a-zA-Z0-9_]*(\.[a-zA-Z_][a-zA-Z0-9_]*)*$/;
+    if (!validIdentifierPattern.test(identifier)) {
+        throw new Error(`Invalid ${context}: "${identifier}". ` +
+            `Identifiers must start with a letter or underscore, followed by alphanumeric characters or underscores. ` +
+            `Schema/table references can use dots (e.g., "schema.table" or "table.column").`);
+    }
+    // Additional check: prevent reserved SQLite keywords that could be dangerous
+    const reservedKeywords = [
+        'PRAGMA', 'ATTACH', 'DETACH', 'VACUUM', 'ANALYZE', 'REINDEX'
+    ];
+    for (const keyword of reservedKeywords) {
+        if (identifier.toUpperCase() === keyword) {
+            throw new Error(`Invalid ${context}: "${identifier}" is a reserved SQLite keyword and cannot be used as an identifier`);
+        }
+    }
+}
+/**
+ * Validates table reference for dynamic table operations
+ */
+export function validateTableReference(tableRef) {
+    validateIdentifier(tableRef, 'table reference');
+    // Additional validation for table references
+    const parts = tableRef.split('.');
+    if (parts.length > 2) {
+        throw new Error(`Invalid table reference: "${tableRef}". ` +
+            `Table references can have at most 2 parts (schema.table).`);
+    }
+    // Validate each part
+    parts.forEach((part, index) => {
+        const context = index === 0 ? (parts.length === 2 ? 'schema name' : 'table name') : 'table name';
+        validateIdentifier(part, context);
+    });
+}
+/**
+ * Validates column reference for dynamic column operations
+ */
+export function validateColumnReference(columnRef) {
+    validateIdentifier(columnRef, 'column reference');
+    // Column references can have: column, table.column, or schema.table.column
+    const parts = columnRef.split('.');
+    if (parts.length > 3) {
+        throw new Error(`Invalid column reference: "${columnRef}". ` +
+            `Column references can have at most 3 parts (schema.table.column).`);
+    }
+    // Validate each part
+    parts.forEach((part, index) => {
+        let context;
+        if (parts.length === 1) {
+            context = 'column name';
+        }
+        else if (parts.length === 2) {
+            context = index === 0 ? 'table name' : 'column name';
+        }
+        else {
+            context = index === 0 ? 'schema name' : (index === 1 ? 'table name' : 'column name');
+        }
+        validateIdentifier(part, context);
+    });
+}
+/**
+ * Validates file paths to prevent path traversal attacks
+ */
+export function validateFilePath(filePath, allowedExtensions) {
+    if (typeof filePath !== 'string') {
+        throw new Error('File path must be a string');
+    }
+    if (filePath.length === 0) {
+        throw new Error('File path cannot be empty');
+    }
+    // Check for path traversal patterns
+    const pathTraversalPatterns = [
+        /\.\./, // Parent directory reference
+        /~\//, // Home directory reference
+        /^\/+/, // Absolute path (starts with /)
+        /^[a-zA-Z]:\\/, // Windows absolute path (C:\)
+        /\\/, // Backslash (Windows path separator)
+        /\x00/, // Null byte injection
+    ];
+    for (const pattern of pathTraversalPatterns) {
+        if (pattern.test(filePath)) {
+            throw new Error(`Invalid file path: "${filePath}" contains path traversal or absolute path patterns. ` +
+                `Only relative paths within the current directory are allowed.`);
+        }
+    }
+    // Validate file extension if specified
+    if (allowedExtensions && allowedExtensions.length > 0) {
+        const hasValidExtension = allowedExtensions.some(ext => filePath.toLowerCase().endsWith(ext.toLowerCase()));
+        if (!hasValidExtension) {
+            throw new Error(`Invalid file extension for "${filePath}". ` +
+                `Allowed extensions: ${allowedExtensions.join(', ')}`);
+        }
+    }
+    // Check for suspicious file names
+    const suspiciousNames = [
+        /^\.+$/, // Only dots
+        /^\s*$/, // Only whitespace
+        /[<>:"|?*]/, // Windows forbidden characters
+    ];
+    for (const pattern of suspiciousNames) {
+        if (pattern.test(filePath)) {
+            throw new Error(`Invalid file path: "${filePath}" contains forbidden characters or is malformed`);
+        }
+    }
+}
+/**
+ * Sanitizes database path for CLI commands
+ */
+export function sanitizeDatabasePath(dbPath) {
+    validateFilePath(dbPath, ['.db', '.sqlite', '.sqlite3', '.db3']);
+    // Ensure the path doesn't escape current directory
+    if (dbPath.includes('..') || dbPath.startsWith('/') || /^[a-zA-Z]:/.test(dbPath)) {
+        throw new Error(`Database path "${dbPath}" must be a relative path within the current directory`);
+    }
+    return dbPath;
+}
+/**
+ * Validates output directory for code generation
+ */
+export function validateOutputDirectory(dirPath) {
+    if (typeof dirPath !== 'string') {
+        throw new Error('Output directory must be a string');
+    }
+    if (dirPath.length === 0) {
+        throw new Error('Output directory cannot be empty');
+    }
+    // Prevent path traversal
+    if (dirPath.includes('..')) {
+        throw new Error(`Output directory "${dirPath}" cannot contain parent directory references (..)`);
+    }
+    // Prevent absolute paths
+    if (dirPath.startsWith('/') || /^[a-zA-Z]:/.test(dirPath)) {
+        throw new Error(`Output directory "${dirPath}" must be a relative path`);
+    }
+    // Validate format
+    const validDirPattern = /^[a-zA-Z0-9_\-./]+$/;
+    if (!validDirPattern.test(dirPath)) {
+        throw new Error(`Invalid output directory: "${dirPath}". ` +
+            `Directory paths must contain only alphanumeric characters, underscores, hyphens, dots, and forward slashes.`);
+    }
+}
+/**
+ * Validates migration name
+ */
+export function validateMigrationName(name) {
+    if (typeof name !== 'string') {
+        throw new Error('Migration name must be a string');
+    }
+    if (name.length === 0) {
+        throw new Error('Migration name cannot be empty');
+    }
+    if (name.length > 100) {
+        throw new Error('Migration name exceeds maximum length of 100 characters');
+    }
+    // Allow only alphanumeric, underscores, and hyphens
+    const validNamePattern = /^[a-zA-Z0-9_\-]+$/;
+    if (!validNamePattern.test(name)) {
+        throw new Error(`Invalid migration name: "${name}". ` +
+            `Migration names must contain only alphanumeric characters, underscores, and hyphens.`);
+    }
+}
+/**
+ * Rate limiting for security-sensitive operations
+ */
+export class RateLimiter {
+    maxAttempts;
+    windowMs;
+    attempts = new Map();
+    constructor(maxAttempts = 10, windowMs = 60000 // 1 minute
+    ) {
+        this.maxAttempts = maxAttempts;
+        this.windowMs = windowMs;
+    }
+    checkLimit(key) {
+        const now = Date.now();
+        const attempts = this.attempts.get(key) || [];
+        // Remove old attempts outside the window
+        const recentAttempts = attempts.filter(time => now - time < this.windowMs);
+        if (recentAttempts.length >= this.maxAttempts) {
+            throw new Error(`Rate limit exceeded for ${key}. Please wait before trying again.`);
+        }
+        recentAttempts.push(now);
+        this.attempts.set(key, recentAttempts);
+        // Cleanup old entries periodically
+        if (this.attempts.size > 1000) {
+            this.cleanup(now);
+        }
+    }
+    cleanup(now) {
+        for (const [key, attempts] of this.attempts.entries()) {
+            const recentAttempts = attempts.filter(time => now - time < this.windowMs);
+            if (recentAttempts.length === 0) {
+                this.attempts.delete(key);
+            }
+            else {
+                this.attempts.set(key, recentAttempts);
+            }
+        }
+    }
+}

package/dist/esm/util/security.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Security utilities for NOORMME
+ * Export all security-related functions for easy import
+ */
+export { validateIdentifier, validateTableReference, validateColumnReference, validateFilePath, sanitizeDatabasePath, validateOutputDirectory, validateMigrationName, RateLimiter, } from './security-validator.js';
+export { safeOrderDirection, safeLimit, safeOffset, safeKeyword, safeLockMode, safeOrderBy, safeBoolean, safeCaseStatement, SafeSQLKeywords, SafeSQLExamples, validateEnum, validateNumericRange, type SafeOrderBy, type SafeCaseWhen, } from './safe-sql-helpers.js';
+/**
+ * Security best practices and guidelines
+ */
+export declare const SecurityGuidelines: {
+    /**
+     * NEVER use sql.raw() or sql.lit() with user input
+     */
+    readonly NEVER_USE_RAW_WITH_USER_INPUT: "Use safe alternatives or parameterized queries";
+    /**
+     * ALWAYS validate dynamic identifiers
+     */
+    readonly ALWAYS_VALIDATE_IDENTIFIERS: "Use validateColumnReference() or validateTableReference()";
+    /**
+     * ALWAYS use whitelists for user-controlled values
+     */
+    readonly ALWAYS_USE_WHITELISTS: "Define allowed values and validate against them";
+    /**
+     * ALWAYS sanitize file paths
+     */
+    readonly ALWAYS_SANITIZE_PATHS: "Use validateFilePath() or sanitizeDatabasePath()";
+    /**
+     * PREFER parameterized queries
+     */
+    readonly PREFER_PARAMETERIZED_QUERIES: "Use sql`${value}` instead of sql.raw()";
+    /**
+     * PREFER safe helpers over raw SQL
+     */
+    readonly PREFER_SAFE_HELPERS: "Use safeOrderDirection(), safeLimit(), etc.";
+};
+/**
+ * Quick security checklist for developers
+ */
+export declare function securityChecklist(): string;
+/**
+ * Common security patterns
+ */
+export declare const SecurityPatterns: {
+    /**
+     * Safe column selection from user input
+     */
+    safeColumnSelection: (userColumn: string, allowedColumns: string[]) => string;
+    /**
+     * Safe table selection from user input
+     */
+    safeTableSelection: (userTable: string, allowedTables: string[]) => string;
+    /**
+     * Safe enum validation
+     */
+    safeEnumValue: <T extends string>(value: string, allowedValues: readonly T[]) => T;
+    /**
+     * Safe numeric range validation
+     */
+    safeNumericValue: (value: number | string, min: number, max: number) => number;
+};

package/dist/esm/util/security.js

@@ -0,0 +1,114 @@
+/// <reference types="./security.d.ts" />
+/**
+ * Security utilities for NOORMME
+ * Export all security-related functions for easy import
+ */
+// Input validation and sanitization
+export { validateIdentifier, validateTableReference, validateColumnReference, validateFilePath, sanitizeDatabasePath, validateOutputDirectory, validateMigrationName, RateLimiter, } from './security-validator.js';
+// Safe SQL helpers
+export { safeOrderDirection, safeLimit, safeOffset, safeKeyword, safeLockMode, safeOrderBy, safeBoolean, safeCaseStatement, SafeSQLKeywords, SafeSQLExamples, validateEnum, validateNumericRange, } from './safe-sql-helpers.js';
+/**
+ * Security best practices and guidelines
+ */
+export const SecurityGuidelines = {
+    /**
+     * NEVER use sql.raw() or sql.lit() with user input
+     */
+    NEVER_USE_RAW_WITH_USER_INPUT: 'Use safe alternatives or parameterized queries',
+    /**
+     * ALWAYS validate dynamic identifiers
+     */
+    ALWAYS_VALIDATE_IDENTIFIERS: 'Use validateColumnReference() or validateTableReference()',
+    /**
+     * ALWAYS use whitelists for user-controlled values
+     */
+    ALWAYS_USE_WHITELISTS: 'Define allowed values and validate against them',
+    /**
+     * ALWAYS sanitize file paths
+     */
+    ALWAYS_SANITIZE_PATHS: 'Use validateFilePath() or sanitizeDatabasePath()',
+    /**
+     * PREFER parameterized queries
+     */
+    PREFER_PARAMETERIZED_QUERIES: 'Use sql`${value}` instead of sql.raw()',
+    /**
+     * PREFER safe helpers over raw SQL
+     */
+    PREFER_SAFE_HELPERS: 'Use safeOrderDirection(), safeLimit(), etc.',
+};
+/**
+ * Quick security checklist for developers
+ */
+export function securityChecklist() {
+    return `
+NOORMME Security Checklist:
+
+✅ Input Validation
+  □ All user inputs validated with whitelists
+  □ Dynamic columns/tables use validateColumnReference()/validateTableReference()
+  □ File paths use validateFilePath() or sanitizeDatabasePath()
+
+✅ SQL Injection Prevention
+  □ No sql.raw() with user input
+  □ No sql.lit() with user input
+  □ Use safe alternatives: safeOrderDirection(), safeLimit(), etc.
+  □ Parameterized queries used for all values
+
+✅ Path Traversal Prevention
+  □ All file operations validated
+  □ No parent directory references (..) allowed
+  □ No absolute paths accepted
+
+✅ Production Readiness
+  □ Environment variables for sensitive config
+  □ Error messages don't leak sensitive info
+  □ Rate limiting enabled for auth endpoints
+  □ Database file permissions set (600/640)
+  □ Dependencies updated regularly
+  □ Backups encrypted and secure
+
+Use this checklist before deploying to production!
+`;
+}
+/**
+ * Common security patterns
+ */
+export const SecurityPatterns = {
+    /**
+     * Safe column selection from user input
+     */
+    safeColumnSelection: (userColumn, allowedColumns) => {
+        if (!allowedColumns.includes(userColumn)) {
+            throw new Error(`Invalid column: ${userColumn}`);
+        }
+        return userColumn;
+    },
+    /**
+     * Safe table selection from user input
+     */
+    safeTableSelection: (userTable, allowedTables) => {
+        if (!allowedTables.includes(userTable)) {
+            throw new Error(`Invalid table: ${userTable}`);
+        }
+        return userTable;
+    },
+    /**
+     * Safe enum validation
+     */
+    safeEnumValue: (value, allowedValues) => {
+        if (!allowedValues.includes(value)) {
+            throw new Error(`Invalid value: ${value}. Allowed: ${allowedValues.join(', ')}`);
+        }
+        return value;
+    },
+    /**
+     * Safe numeric range validation
+     */
+    safeNumericValue: (value, min, max) => {
+        const num = typeof value === 'string' ? parseFloat(value) : value;
+        if (isNaN(num) || num < min || num > max) {
+            throw new Error(`Invalid number: ${value}. Must be between ${min} and ${max}`);
+        }
+        return num;
+    },
+};

package/dist/esm/watch/schema-watcher.js

@@ -16,11 +16,13 @@ export class SchemaWatcher {
         this.schemaDiscovery = schemaDiscovery;
         this.logger = logger;
         this.options = options;
+        // Merge options, giving priority to explicitly passed values
+        const defaultEnabled = process.env.NODE_ENV === 'development';
         this.options = {
             pollInterval: 5000,
             ignoreViews: true,
             ignoredTables: [],
-            enabled: process.env.NODE_ENV === 'development',
+            enabled: options.enabled !== undefined ? options.enabled : defaultEnabled,
             ...options
         };
     }
@@ -38,29 +40,40 @@ export class SchemaWatcher {
         }
         this.logger.info('Starting schema change monitoring...');
         // Get initial schema snapshot
-        const initialSchema = await this.getCurrentSchema();
-        this.lastSchemaHash = this.hashSchema(initialSchema);
+        try {
+            const initialSchema = await this.getCurrentSchema();
+            this.lastSchemaHash = this.hashSchema(initialSchema);
+        }
+        catch (error) {
+            this.logger.error('Failed to get initial schema snapshot:', error);
+            // Set a default hash to allow watching to continue
+            this.lastSchemaHash = '0';
+        }
         this.isWatching = true;
         this.intervalId = setInterval(() => {
             this.checkForChanges().catch(error => {
                 this.logger.error('Error checking for schema changes:', error);
             });
         }, this.options.pollInterval);
+        // Unref the interval to allow the process to exit
+        if (this.intervalId && typeof this.intervalId.unref === 'function') {
+            this.intervalId.unref();
+        }
         this.logger.info(`Schema watcher started (polling every ${this.options.pollInterval}ms)`);
     }
     /**
      * Stop watching for schema changes
      */
     stopWatching() {
-        if (!this.isWatching) {
-            return;
-        }
         if (this.intervalId) {
             clearInterval(this.intervalId);
             this.intervalId = null;
         }
         this.isWatching = false;
-        this.logger.info('Schema watcher stopped');
+        this.callbacks = []; // Clear callbacks on stop
+        if (this.logger) {
+            this.logger.info('Schema watcher stopped');
+        }
     }
     /**
      * Register callback for schema changes
@@ -84,6 +97,8 @@ export class SchemaWatcher {
         try {
             const currentSchema = await this.getCurrentSchema();
             const currentHash = this.hashSchema(currentSchema);
+            // Debug logging
+            this.logger.debug(`Schema check - Last hash: ${this.lastSchemaHash}, Current hash: ${currentHash}, Tables: ${currentSchema.tables.length}`);
             if (this.lastSchemaHash && currentHash !== this.lastSchemaHash) {
                 this.logger.info('Schema changes detected, analyzing...');
                 // Since we only have the hash, we'll need to do a full schema comparison
@@ -96,6 +111,10 @@ export class SchemaWatcher {
                 }
                 return changes;
             }
+            // Update hash even if no changes detected yet (for first check after initialization)
+            if (!this.lastSchemaHash) {
+                this.lastSchemaHash = currentHash;
+            }
             return [];
         }
         catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "noormme",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "NOORMME - The NO-ORM for Normies. SQLite automation so simple, even normies can use it.",
   "repository": {
     "type": "git",

package/dist/cjs/performance/query-analyzer.d.ts

@@ -1,89 +0,0 @@
-import type { Kysely } from '../kysely.js';
-import { Logger } from '../logging/logger.js';
-import { SchemaInfo } from '../types/index.js';
-export interface QueryMetrics {
-    query: string;
-    executionTime: number;
-    timestamp: Date;
-    table?: string;
-    operation?: string;
-}
-export interface PerformanceWarning {
-    type: 'n_plus_one' | 'missing_index' | 'slow_query' | 'full_table_scan' | 'large_result_set';
-    message: string;
-    suggestion: string;
-    query?: string;
-    table?: string;
-    severity: 'low' | 'medium' | 'high';
-}
-export interface QueryAnalyzerOptions {
-    enabled?: boolean;
-    slowQueryThreshold?: number;
-    nPlusOneDetection?: boolean;
-    missingIndexDetection?: boolean;
-    largeResultSetThreshold?: number;
-}
-/**
- * Analyzes query performance and provides warnings for optimization
- */
-export declare class QueryAnalyzer {
-    private db;
-    private logger;
-    private schemaInfo;
-    private options;
-    private queryHistory;
-    private recentQueries;
-    private maxHistorySize;
-    constructor(db: Kysely<any>, logger: Logger, schemaInfo: SchemaInfo, options?: QueryAnalyzerOptions);
-    /**
-     * Record a query execution for analysis
-     */
-    recordQuery(query: string, executionTime: number, resultCount?: number, table?: string): void;
-    /**
-     * Analyze a query for performance issues
-     */
-    private analyzeQuery;
-    /**
-     * Detect N+1 query patterns
-     */
-    private detectNPlusOne;
-    /**
-     * Check for missing indexes based on WHERE clauses
-     */
-    private checkForMissingIndexes;
-    /**
-     * Normalize query for comparison (remove dynamic values)
-     */
-    private normalizeQuery;
-    /**
-     * Extract operation type from query
-     */
-    private extractOperation;
-    /**
-     * Log performance warning
-     */
-    private logWarning;
-    /**
-     * Get emoji for warning type
-     */
-    private getWarningEmoji;
-    /**
-     * Get performance statistics
-     */
-    getPerformanceStats(): {
-        totalQueries: number;
-        averageExecutionTime: number;
-        slowQueries: number;
-        warningCount: {
-            [key: string]: number;
-        };
-    };
-    /**
-     * Clear query history
-     */
-    clearHistory(): void;
-    /**
-     * Update schema info for index checking
-     */
-    updateSchema(schemaInfo: SchemaInfo): void;
-}