objection 3.6.0 → 3.7.0

package/lib/model/AjvValidator.js

@@ -215,7 +215,22 @@ class AjvValidator extends Validator {
       this.setupAjv(this.ajvQueryProps);
     }
 
-    return this.ajvQueryProps.compile(jsonSchema);
+    for (;;) {
+      try {
+        return this.ajvQueryProps.compile(jsonSchema);
+      } catch (err) {
+        // The schemas of other model classes that `$ref`s point to aren't added
+        // to this instance. Copy them over from the normal instance when needed.
+        const validator =
+          err instanceof Ajv.MissingRefError && this.ajv.getSchema(err.missingSchema);
+
+        if (!validator) {
+          throw err;
+        }
+
+        this.ajvQueryProps.addSchema(validator.schema, err.missingSchema);
+      }
+    }
   }
 }
 
@@ -357,7 +372,9 @@ function fieldExpressionPath(key) {
     return [key];
   }
 
-  if (parsed.access.some((access) => access.type !== 'object')) {
+  // Numeric keys like the `0` in `tags:0` also access array elements when the
+  // json value is an array, so treat them like `[0]`.
+  if (parsed.access.some((access) => access.type !== 'object' || /^-?\d+$/.test(access.ref))) {
     return null;
   }
 
@@ -470,6 +487,11 @@ function jsonSchemaWithoutRequiredKeys(jsonSchema, keys) {
 }
 
 function jsonSchemaWithoutRequired(jsonSchema) {
+  // Boolean schemas (`true` / `false`) have no `required` to strip.
+  if (!isObject(jsonSchema)) {
+    return jsonSchema;
+  }
+
   // `not` is intentionally left untouched: Stripping `required` inside it
   // would turn it into a schema that rejects everything (e.g.
   // `not: { required: ['a'] }` -> `not: {}`). Kept as is, it still holds for
@@ -506,17 +528,18 @@ function definitionsWithoutRequired(jsonSchema, prop) {
 }
 
 function subSchemaWithoutRequired(jsonSchema, prop) {
-  if (jsonSchema[prop]) {
+  if (jsonSchema[prop] !== undefined) {
     if (Array.isArray(jsonSchema[prop])) {
       const schemaArray = jsonSchema[prop].map(jsonSchemaWithoutRequired);
-      const nonEmptySchemaArray = schemaArray.filter(isNotEmptyObject);
+      const nonEmptySchemaArray = schemaArray.filter((schema) => !matchesAnything(schema));
 
       // An `anyOf` or `oneOf` option that only consisted of `required` is
       // empty once `required` is stripped, and an empty schema matches any
-      // patch, just like the stripped `required` keywords elsewhere. Drop the
-      // whole keyword then: requiring the patch to match one of the remaining
-      // options would reject valid patches, and with `oneOf` keeping the empty
-      // option would fail every patch that also matches another option.
+      // patch, just like the stripped `required` keywords elsewhere and the
+      // `true` schema. Drop the whole keyword then: requiring the patch to
+      // match one of the remaining options would reject valid patches, and
+      // with `oneOf` keeping the empty option would fail every patch that also
+      // matches another option.
       if (prop !== 'allOf' && nonEmptySchemaArray.length !== schemaArray.length) {
         return {};
       } else if (nonEmptySchemaArray.length !== 0) {
@@ -548,8 +571,8 @@ function subSchemaWithoutRequired(jsonSchema, prop) {
   }
 }
 
-function isNotEmptyObject(obj) {
-  return Object.keys(obj).length !== 0;
+function matchesAnything(schema) {
+  return schema === true || (isObject(schema) && Object.keys(schema).length === 0);
 }
 
 module.exports = {

package/lib/model/modelClone.js

@@ -81,8 +81,6 @@ function cloneObject(value) {
     return cloneArray(value);
   } else if (value.$isObjectionModel) {
     return clone(value, false, false);
-  } else if (Buffer.isBuffer(value)) {
-    return new Buffer(value);
   } else {
     return cloneDeep(value);
   }

package/lib/queryBuilder/QueryBuilder.js

@@ -8,6 +8,7 @@ const { ValidationErrorType } = require('../model/ValidationError');
 const { isObject, isString, isFunction, last, flatten } = require('../utils/objectUtils');
 const { RelationExpression, DuplicateRelationError } = require('./RelationExpression');
 const { assertIdNotUndefined, assertHasIdColumn } = require('../utils/assert');
+const { deprecate } = require('../utils/deprecate');
 
 const { Selection } = require('./operations/select/Selection');
 
@@ -176,7 +177,7 @@ class QueryBuilder extends QueryBuilderBase {
   }
 
   isExplicitlyResolvedOrRejected() {
-    return !!(this._explicitRejectValue || this._explicitResolveValue);
+    return this._explicitRejectValue !== null || this._explicitResolveValue !== null;
   }
 
   isExecutable() {
@@ -261,7 +262,14 @@ class QueryBuilder extends QueryBuilderBase {
     eagerOp.graphOptions = { ...eagerOp.graphOptions, ...graphOptions };
 
     if (joinOperation) {
-      eagerOp.joinOperations.push({ expression: parsedExp, joinOperation });
+      if (eagerOp instanceof JoinEagerOperation) {
+        eagerOp.joinOperations.push({ expression: parsedExp, joinOperation });
+      } else {
+        deprecate(
+          'The joinOperation option only applies to withGraphJoined() and is ignored for the ' +
+            `fetched relations "${parsedExp.toString()}".`,
+        );
+      }
     }
 
     checkMixedEager(this);
@@ -501,17 +509,31 @@ class QueryBuilder extends QueryBuilderBase {
       await joinEagerOp.onBefore3(builder);
     }
 
-    const countQuery = knex.count('* as count').from((knexBuilder) => {
-      // Also clear the order on the built knex query, since `orderBy` calls
-      // can be added at build time, e.g. by a relation's `modify`.
-      knexBuilder = builder.toKnexQuery(knexBuilder).clearOrder();
+    // Also clear the order on the built knex query, since `orderBy` calls
+    // can be added at build time, e.g. by a relation's `modify`.
+    const buildQuery = (knexBuilder) => builder.toKnexQuery(knexBuilder).clearOrder();
 
-      if (joinEagerOp) {
+    const countQuery = knex.count('* as count').from((knexBuilder) => {
+      if (!joinEagerOp) {
+        buildQuery(knexBuilder);
+      } else {
         // The joins of `withGraphJoined` return one row per joined child.
         // Count the distinct root models instead.
-        const tableRef = builder.tableRef();
         const idColumns = builder.modelClass().getIdColumnArray();
-        knexBuilder.clearSelect().distinct(idColumns.map((col) => `${tableRef}.${col}`));
+
+        if (refersToSelections(builder)) {
+          // `having`, and `groupBy` with an alias, may refer to aliased
+          // selections, so keep them and select the distinct ids from the
+          // result instead.
+          knexBuilder.distinct(idColumns).from((knexBuilder) => {
+            buildQuery(knexBuilder).as('inner');
+          });
+        } else {
+          const tableRef = builder.tableRef();
+          buildQuery(knexBuilder)
+            .clearSelect()
+            .distinct(idColumns.map((col) => `${tableRef}.${col}`));
+        }
       }
 
       knexBuilder.as('temp');
@@ -1171,6 +1193,29 @@ function getEagerAlgorithmByName(builder, name) {
   }
 }
 
+// Returns true if the `having` or `groupBy` clauses of `builder` may refer to
+// aliased selections (#2329).
+function refersToSelections(builder) {
+  if (builder.has(/having/)) {
+    return true;
+  }
+
+  const aliases = builder
+    .findAllSelections()
+    .map((selection) => selection.alias)
+    .filter((alias) => !!alias);
+
+  let refersToAlias = false;
+
+  builder.forEachOperation(/^groupBy$/, (op) => {
+    if (flatten(op.args).some((arg) => aliases.includes(arg))) {
+      refersToAlias = true;
+    }
+  });
+
+  return refersToAlias;
+}
+
 function getEagerAlgorithmOfOperation(builder, eagerOp) {
   if (eagerOp instanceof JoinEagerOperation) {
     return getJoinEagerAlgorithm(builder);
@@ -1198,7 +1243,8 @@ function groupByEagerAlgorithm(builder, expression) {
 
   for (const childName of node.$childNames) {
     const eagerOp = findEagerOperations(builder).find(
-      (op) => op.expression.node.$allRecursive || op.expression.node[childName],
+      (op) =>
+        op.expression.node.$allRecursive || op.expression.node.$childNames.includes(childName),
     );
 
     const algorithm = eagerOp ? getEagerAlgorithmOfOperation(builder, eagerOp) : defaultAlgorithm;

package/lib/queryBuilder/RelationExpression.js

@@ -129,7 +129,8 @@ class RelationExpression {
       return new RelationExpression(this.node, this.recursionDepth + 1);
     }
 
-    const child = this.node[childName];
+    // Don't mistake inherited properties like `constructor` for children.
+    const child = this.node.$childNames.includes(childName) ? this.node[childName] : null;
 
     if (child) {
       return new RelationExpression(child);
@@ -292,7 +293,7 @@ function modelToNode(model, node) {
     const relName = relationNames[r];
 
     if (model[relName] !== undefined) {
-      let childNode = node[relName];
+      let childNode = node.$childNames.includes(relName) ? node[relName] : null;
 
       if (!childNode) {
         childNode = newNode(relName);
@@ -402,8 +403,9 @@ function mergeNodes(node1, node2) {
     node.$childNames = union(node1.$childNames, node2.$childNames);
 
     for (const childName of node.$childNames) {
-      const child1 = node1[childName];
-      const child2 = node2[childName];
+      // Don't mistake inherited properties like `constructor` for children.
+      const child1 = node1.$childNames.includes(childName) ? node1[childName] : null;
+      const child2 = node2.$childNames.includes(childName) ? node2[childName] : null;
 
       if (child1 && child2) {
         node[childName] = mergeNodes(child1, child2);

package/lib/queryBuilder/graph/GraphOptions.js

@@ -15,6 +15,7 @@ const UNRELATE = 'unrelate';
 const INSERT_MISSING = 'insertMissing';
 const FETCH_STRATEGY = 'fetchStrategy';
 const ALLOW_REFS = 'allowRefs';
+const ALLOW_MARKERS = 'allowMarkers';
 
 const OPTION_NAMES = [
   NO_RELATE,
@@ -28,6 +29,7 @@ const OPTION_NAMES = [
   INSERT_MISSING,
   FETCH_STRATEGY,
   ALLOW_REFS,
+  ALLOW_MARKERS,
 ];
 
 // The options that are matched against the relation path of each node, see
@@ -52,7 +54,8 @@ const FetchStrategy = {
 
 class GraphOptions {
   // `rootRelationPath` is the relation path of the root node of a recursive
-  // upsert in the original graph, against which relation expressions match.
+  // upsert in the original graph, against which the relation paths and
+  // expressions of the options match.
   constructor(options, rootRelationPath = []) {
     if (options instanceof GraphOptions) {
       this.options = options.options;
@@ -61,10 +64,6 @@ class GraphOptions {
       this.options = parseRelationExpressions(options);
       this.rootRelationPath = rootRelationPath;
     }
-
-    // Caches the result of matching relation expressions against relation
-    // paths, by option name and relation path key.
-    this.expressionMatches = new Map();
   }
 
   isFetchStrategy(strategy) {
@@ -206,33 +205,23 @@ class GraphOptions {
     return !!this.options[ALLOW_REFS];
   }
 
-  rebasedOptions(newRoot) {
-    const newOpt = {};
-    const newRootRelationPath = newRoot.relationPathKey;
-
-    for (const name of Object.keys(this.options)) {
-      const value = this.options[name];
-
-      if (Array.isArray(value)) {
-        newOpt[name] = value
-          .filter((it) => it === newRootRelationPath || it.startsWith(`${newRootRelationPath}.`))
-          .map((it) => it.slice(newRootRelationPath.length + 1))
-          .filter((it) => !!it);
-      } else {
-        newOpt[name] = value;
-      }
-    }
+  allowMarkers() {
+    return !!this.options[ALLOW_MARKERS];
+  }
 
-    return new GraphOptions(newOpt, [...this.rootRelationPath, ...newRoot.relationPath]);
+  // The options of recursive upserts keep matching against the relation paths
+  // of the original graph, which the relation paths of the new root lead to.
+  rebasedOptions(newRoot) {
+    return new GraphOptions(this.options, [...this.rootRelationPath, ...newRoot.relationPath]);
   }
 
   _hasOption(node, optionName) {
     const option = this.options[optionName];
 
     if (isRelationExpression(option)) {
-      return this._matchesRelationExpression(node, optionName, option);
+      return matchesRelationExpression(option, this._relationPath(node));
     } else if (Array.isArray(option)) {
-      return option.indexOf(node.relationPathKey) !== -1;
+      return option.includes(this._relationPath(node).join('.'));
     } else if (typeof option === 'boolean') {
       return option;
     } else if (option === undefined) {
@@ -244,36 +233,9 @@ class GraphOptions {
     }
   }
 
-  // A node matches a relation expression when its relation path leads to a
-  // leaf of the expression, like it would match the same relation paths in an
-  // array: `'movies.reviews'` matches `movies.reviews` but not `movies`.
-  // `'*'` matches all relations below it and recursive expressions like
-  // `'parent.^'` match every level of the recursion. The root has no relation
-  // path and never matches.
-  _matchesRelationExpression(node, optionName, expression) {
-    const relationPath = [...this.rootRelationPath, ...node.relationPath];
-
-    if (relationPath.length === 0) {
-      return false;
-    }
-
-    const relationPathKey = relationPath.join('.');
-
-    let matches = this.expressionMatches.get(optionName);
-
-    if (!matches) {
-      matches = new Map();
-      this.expressionMatches.set(optionName, matches);
-    }
-
-    let isMatch = matches.get(relationPathKey);
-
-    if (isMatch === undefined) {
-      isMatch = matchesRelationPath(expression, relationPath);
-      matches.set(relationPathKey, isMatch);
-    }
-
-    return isMatch;
+  // The relation path of the node in the original graph, see `rebasedOptions()`.
+  _relationPath(node) {
+    return [...this.rootRelationPath, ...node.relationPath];
   }
 }
 
@@ -344,7 +306,17 @@ function findAlias(node) {
   return null;
 }
 
-function matchesRelationPath(expression, relationPath) {
+// A relation path matches a relation expression when it leads to a leaf of
+// the expression, like it would match the same relation paths in an array:
+// `'movies.reviews'` matches `movies.reviews` but not `movies`. `'*'` matches
+// all relations below it and recursive expressions like `'parent.^'` match
+// every level of the recursion. The root has no relation path and never
+// matches.
+function matchesRelationExpression(expression, relationPath) {
+  if (relationPath.length === 0) {
+    return false;
+  }
+
   for (const relationName of relationPath) {
     expression = expression.childExpression(relationName);
 

package/lib/queryBuilder/graph/GraphUpsert.js

@@ -245,6 +245,7 @@ function checkForErrors(builder) {
     checkForNotFoundErrors(graphData, builder);
     checkForUnallowedRelationErrors(graphData, builder);
     checkForUnallowedReferenceErrors(graphData, builder);
+    checkForUnallowedMarkerErrors(graphData, builder);
     checkForRootUnrelateOrDeleteErrors(graphData, builder);
 
     if (graphData.graphOptions.isInsertOnly()) {
@@ -344,6 +345,27 @@ function checkForUnallowedReferenceErrors(graphData, builder) {
   }
 }
 
+// `#unrelate` and `#delete` markers come from the graph data, which may be
+// untrusted input. Like `#ref`, they have to be allowed explicitly (#2410).
+function checkForUnallowedMarkerErrors(graphData, builder) {
+  const { graph, graphOptions } = graphData;
+
+  if (graphOptions.allowMarkers()) {
+    return;
+  }
+
+  const node = graph.nodes.find((node) => node.toBeUnrelatedOrDeleted);
+
+  if (node) {
+    const { graphUnrelateProp, graphDeleteProp } = node.modelClass;
+
+    throw builder.modelClass().createValidationError({
+      type: ValidationErrorType.InvalidGraph,
+      message: `${graphUnrelateProp} and ${graphDeleteProp} markers are not allowed in a graph by default. see the allowMarkers insert/upsert graph option`,
+    });
+  }
+}
+
 function checkForRootUnrelateOrDeleteErrors(graphData, builder) {
   for (const node of graphData.graph.nodes) {
     if (!node.parentEdge && node.toBeUnrelatedOrDeleted) {

package/lib/queryBuilder/graph/insert/GraphInsert.js

@@ -140,6 +140,8 @@ class GraphInsert extends GraphOperation {
       edge.relation.isObjectionBelongsToOneRelation &&
       edge.isOwnerNode(node) &&
       edge.relatedNode.isReference &&
+      // The owner is patched by its id, which models without one don't have (#2305).
+      node.modelClass.getIdColumnArray().length > 0 &&
       // Both ends need to be inserted for the foreign key to be patched in later.
       this.graphOptions.shouldInsert(node, this.graphData) &&
       this.graphOptions.shouldInsert(edge.relatedNode.referencedNode, this.graphData) &&

package/lib/queryBuilder/operations/InstanceUpdateOperation.js

@@ -37,7 +37,12 @@ class InstanceUpdateOperation extends UpdateOperation {
     }
 
     result = await super.onAfter2(builder, result);
-    this.instance.$set(this.model);
+
+    // A query resolved without updating anything, e.g. with `none()`, leaves
+    // the instance untouched.
+    if (!this.isResolvedWithoutUpdate(builder)) {
+      this.instance.$set(this.model);
+    }
 
     if (isObject(result)) {
       this.instance.$set(result);

package/lib/queryBuilder/operations/UpdateOperation.js

@@ -14,6 +14,7 @@ class UpdateOperation extends QueryBuilderOperation {
 
     this.model = null;
     this.modelOptions = Object.assign({}, this.opt.modelOptions || {});
+    this.hasNothingToUpdate = false;
   }
 
   onAdd(builder, args) {
@@ -34,10 +35,19 @@ class UpdateOperation extends QueryBuilderOperation {
 
     if (isEmpty(row)) {
       // Resolve the query if there is nothing to update.
+      this.hasNothingToUpdate = !builder.isExplicitlyResolvedOrRejected();
       builder.resolve(0);
     }
   }
 
+  // Returns true if the query was resolved without updating anything, e.g.
+  // with `none()` or `resolve()` in a hook, but not if it was only resolved
+  // because there is nothing to update in the table, as the update still
+  // applies to everything else (#2184).
+  isResolvedWithoutUpdate(builder) {
+    return builder.isExplicitlyResolvedOrRejected() && !this.hasNothingToUpdate;
+  }
+
   onBuildKnex(knexBuilder, builder) {
     const json = this.model.$toDatabaseJson(builder);
     const convertedJson = convertFieldExpressionsToRaw(builder, this.model, json);
@@ -56,6 +66,7 @@ class UpdateOperation extends QueryBuilderOperation {
   clone() {
     const clone = super.clone();
     clone.model = this.model;
+    clone.hasNothingToUpdate = this.hasNothingToUpdate;
     return clone;
   }
 }

package/lib/queryBuilder/operations/whereInComposite/WhereInCompositeMsSqlOperation.js

@@ -42,7 +42,9 @@ class WhereInCompositeMsSqlOperation extends ObjectionToKnexConvertingOperation
         knexBuilder,
         columns,
         helperColumns,
-        values.as(knex.raw(`V(${helperColumns.map((_) => '??')})`, helperColumns)),
+        // knex only accepts strings as aliases, so the subquery is aliased in
+        // a raw query.
+        knex.raw(`? AS V(${helperColumns.map((_) => '??')})`, [values, ...helperColumns]),
       );
     }
   }

package/lib/queryBuilder/operations/whereInComposite/WhereInCompositeSqliteOperation.js

@@ -48,18 +48,13 @@ function isCompositeKey(columns) {
 }
 
 function buildCompositeArgs(columns, values) {
-  if (!Array.isArray(values)) {
-    // If the `values` is not an array of values but a function or a subquery
-    // we have no way to implement this method.
-    throw new Error(`sqlite doesn't support multi-column where in clauses`);
-  }
-
-  if (values.length === 0) {
+  if (!Array.isArray(values) || values.length === 0) {
     // knex turns an empty `whereIn` into `1 = 0` and an empty `whereNotIn`
-    // into `1 = 1`.
+    // into `1 = 1`. Subqueries are compared as row values, which sqlite
+    // supports since version 3.15.
     return {
       method: 'whereIn',
-      args: [columns, []],
+      args: [columns, values],
     };
   }
 

package/lib/queryBuilder/parsers/relationExpressionParser.js

@@ -943,7 +943,7 @@ function peg$parse(input, options) {
   }
 
   function assertDuplicateRelation(node, expr) {
-    if (expr.$name in node) {
+    if (Object.prototype.hasOwnProperty.call(node, expr.$name)) {
       console.warn(
         `Duplicate relation "${expr.$name}" in a relation expression. You should use "a.[b, c]" instead of "[a.b, a.c]". This will cause an error in objection 2.0`,
       );

package/lib/queryBuilder/parsers/relationExpressionParser.pegjs

@@ -1,6 +1,6 @@
 {
   function assertDuplicateRelation(node, expr) {
-    if (expr.$name in node) {
+    if (Object.prototype.hasOwnProperty.call(node, expr.$name)) {
       console.warn(`Duplicate relation "${expr.$name}" in a relation expression. You should use "a.[b, c]" instead of "[a.b, a.c]". This will cause an error in objection 2.0`);
 
       // TODO: enable for v2.0.

package/lib/queryBuilder/transformations/WrapMysqlModifySubqueryTransformation.js

@@ -2,8 +2,6 @@
 
 const { QueryTransformation } = require('./QueryTransformation');
 const { isMySql } = require('../../utils/knexUtils');
-const { once } = require('../../utils/objectUtils');
-const getJoinBuilder = once(() => require('../JoinBuilder').JoinBuilder);
 
 /**
  * Mysql doesn't allow queries like this:
@@ -32,11 +30,10 @@ class WrapMysqlModifySubqueryTransformation extends QueryTransformation {
       return query;
     }
 
-    // This transformation should not apply to join builder, otherwise it causes:
-    // "TypeError: parentQuery.isUpdate is not a function"
-    const JoinBuilder = getJoinBuilder();
-    if (parentQuery instanceof JoinBuilder) {
-      return query;
+    // Subqueries in where groups and join clauses are converted with a
+    // partial builder as their parent. Use the query that they belong to.
+    while (parentQuery.isPartial() && parentQuery.parentQuery()) {
+      parentQuery = parentQuery.parentQuery();
     }
 
     // This transformation only applies to update and delete queries.

package/lib/relations/Relation.js

@@ -103,6 +103,7 @@ class Relation {
     relation.joinTableRelatedProp = this.joinTableRelatedProp;
     relation.joinTableBeforeInsert = this.joinTableBeforeInsert;
     relation.joinTableExtras = this.joinTableExtras;
+    relation.joinTableModify = this.joinTableModify;
 
     return relation;
   }