oracledb 7.0.0 → 26.0.0

package/lib/oracledb.js

@@ -66,6 +66,7 @@ const SodaCollection = require('./sodaCollection.js');
 const SodaDocCursor = require('./sodaDocCursor.js');
 const SodaDocument = require('./sodaDocument.js');
 const SodaOperation = require('./sodaOperation.js');
+const securityContextProviderModule = require('./securityContextProvider.js');
 const EndUserSecurityContext = require('./endUserSecurityContext.js');
 
 const poolCache = {};
@@ -417,6 +418,12 @@ async function _verifyOptions(options, inCreatePool) {
     outOptions.appContext = options.appContext;
   }
 
+  // txnPriority must be a supported value
+  if (options.txnPriority !== undefined) {
+    errors.assertTxnPriority(options.txnPriority);
+    outOptions.txnPriority = options.txnPriority;
+  }
+
   // check pool specific options
   if (inCreatePool) {
 
@@ -631,6 +638,11 @@ async function createPool(options) {
       errors.throwWrapErr(error, errors.ERR_CALLOUT_FN);
     }
   }
+  // Connect-string parsing can rebuild the options object and omit internal
+  // fields. Preserve the hook-provided unified-security state before that.
+  const securityContextProviderForPool = options._securityContextProvider;
+  // This is driver-only state and must not be passed to the implementation.
+  delete options._securityContextProvider;
   options = await _updateUserOptionsFromConnectString(options, true);
   const sessionCallback = options.sessionCallback;
   if (typeof sessionCallback === 'function')
@@ -715,6 +727,7 @@ async function createPool(options) {
   }
 
   pool._setup(options, poolAlias);
+  pool._securityContextProvider = securityContextProviderForPool;
   pool._sessionCallback = sessionCallback;
   pool.on('_afterPoolClose', () => {
     if (pool.poolAlias) {
@@ -781,6 +794,9 @@ async function getConnection(a1) {
       errors.throwWrapErr(error, errors.ERR_CALLOUT_FN);
     }
   }
+  const securityContextProviderForConnection = options._securityContextProvider;
+  // This is driver-only state and must not be passed to the implementation.
+  delete options._securityContextProvider;
   // create a standalone connection
   options = await _updateUserOptionsFromConnectString(options, false);
   settings.addToOptions(options,
@@ -799,6 +815,7 @@ async function getConnection(a1) {
   }
   const conn = new Connection();
   conn._impl = new impl.ConnectionImpl();
+  conn._impl._securityContextProvider = securityContextProviderForConnection;
 
   conn._impl._connectString = options.connectString;
   conn._impl._user = options.user;
@@ -1213,6 +1230,16 @@ function registerConfigurationProviderHook(configProvider, fn) {
   registeredConfigProviderHooks[configProvider] = fn;
 }
 
+//-----------------------------------------------------------------------------
+// getSecurityContextProvider()
+//
+// Exposes the internal security context provider helpers without requiring
+// callers to reference the module path directly.
+//-----------------------------------------------------------------------------
+function getSecurityContextProvider() {
+  return securityContextProviderModule;
+}
+
 //-----------------------------------------------------------------------------
 // enquoteLiteral()
 //
@@ -1302,6 +1329,7 @@ module.exports = {
   createPool: nodbUtil.callbackify(nodbUtil.wrapFn(createPool)),
   getNetworkServiceNames: nodbUtil.callbackify(nodbUtil.wrapFn(getNetworkServiceNames)),
   getPool,
+  getSecurityContextProvider,
   initOracleClient,
   isQualifiedSqlName,
   isSimpleSqlName,
@@ -1500,6 +1528,12 @@ module.exports = {
   ARRAY: constants.OUT_FORMAT_ARRAY,
   OBJECT: constants.OUT_FORMAT_OBJECT,
 
+  // txnPriority
+  TXN_PRIORITY_HIGH: constants.TXN_PRIORITY_HIGH,
+  TXN_PRIORITY_MEDIUM: constants.TXN_PRIORITY_MEDIUM,
+  TXN_PRIORITY_LOW: constants.TXN_PRIORITY_LOW,
+  TXN_PRIORITY_DEFAULT: constants.TXN_PRIORITY_DEFAULT,
+
   // Trace Interface
   traceHandler,
 

package/lib/pool.js

@@ -1,4 +1,4 @@
-// Copyright (c) 2016, 2025, Oracle and/or its affiliates.
+// Copyright (c) 2016, 2026, Oracle and/or its affiliates.
 
 //-----------------------------------------------------------------------------
 //
@@ -115,6 +115,7 @@ class Pool extends EventEmitter {
     this._user = options.user;
     this._connectString = options.connectString;
     this._status = constants.POOL_STATUS_OPEN;
+    // Current number of connections that are out for processing or being used
     this._connectionsOut = 0;
     this._poolAlias = poolAlias;
     this._bgRequestHandler();
@@ -514,6 +515,9 @@ class Pool extends EventEmitter {
       this._connectionsOut += 1;
       this._pendingRequestQueue.delete(request);
       conn._impl = await this._impl.getConnection(request.options);
+      // Each acquired connection uses the provider configured for this pool.
+      // Pools can have distinct Azure, OCI, or custom OBO configurations.
+      conn._impl._securityContextProvider = this._securityContextProvider;
       conn._pool = this;
       await this._tagFixup(conn, request.options.tag);
       if (request.isWaiting)
@@ -572,12 +576,12 @@ class Pool extends EventEmitter {
   // _processRequest' to decrease connectionsOut & wake up _bgRequestWaiter
   //---------------------------------------------------------------------------
   async _release(impl, options) {
-    this._connectionsOut -= 1;
     try {
       // Directly close the connection using the underlying connection impl
       if (impl)
         await impl.close(options);
     } finally {
+      this._connectionsOut -= 1;
       if (this._connectionsOut == 0)
         this.emit('_allCheckedIn');
       setImmediate(() => {

package/lib/queryStream.js

@@ -1,4 +1,4 @@
-// Copyright (c) 2015, 2023, Oracle and/or its affiliates.
+// Copyright (c) 2015, 2026, Oracle and/or its affiliates.
 
 //-----------------------------------------------------------------------------
 //
@@ -31,10 +31,11 @@ const { Readable } = require('stream');
 
 class QueryStream extends Readable {
 
-  constructor(rs) {
+  constructor(rs, rowsPerDataEvent = 1) {
     super({ objectMode: true });
     this._fetching = false;
     this._numRows = 0;
+    this._rowsPerDataEvent = rowsPerDataEvent;
 
     // calling open via process.nextTick to allow event handlers to be
     // registered prior to the events being emitted
@@ -95,10 +96,17 @@ class QueryStream extends Readable {
     // created via ResultSet.toQueryStream()
     try {
       this._fetching = true;
+      const rows = [];
       this._resultSet._allowGetRowCall = true;
-      const row = await this._resultSet.getRow();
-      if (row) {
-        this.push(row);
+      for (let i = 0; i < this._rowsPerDataEvent; i++) {
+        const row = await this._resultSet.getRow();
+        if (!row)
+          break;
+        rows.push(row);
+        this._resultSet._allowGetRowCall = true;
+      }
+      if (rows.length > 0) {
+        this.push(this._rowsPerDataEvent === 1 ? rows[0] : rows);
       } else {
         this.push(null);
       }

package/lib/resultset.js

@@ -341,8 +341,15 @@ class ResultSet {
   //
   // Converts a result set to a QueryStream object.
   //---------------------------------------------------------------------------
-  toQueryStream() {
-    errors.assertArgCount(arguments, 0, 0);
+  toQueryStream(options) {
+    errors.assertArgCount(arguments, 0, 1);
+    if (arguments.length == 1) {
+      errors.assertParamValue(nodbUtil.isObject(options), 1);
+      options = {...options};
+    } else {
+      options = {};
+    }
+    errors.assertParamPropUnsignedIntNonZero(options, 1, "rowsPerDataEvent");
 
     if (this._processingStarted) {
       errors.throwErr(errors.ERR_CANNOT_CONVERT_RS_TO_STREAM);
@@ -354,7 +361,7 @@ class ResultSet {
 
     this._convertedToStream = true;
 
-    return new QueryStream(this);
+    return new QueryStream(this, options.rowsPerDataEvent);
   }
 
   [Symbol.asyncIterator]() {

package/lib/securityContextProvider.js

@@ -0,0 +1,206 @@
+// Copyright (c) 2026, Oracle and/or its affiliates.
+
+//-----------------------------------------------------------------------------
+//
+// This software is dual-licensed to you under the Universal Permissive License
+// (UPL) 1.0 as shown at https://oss.oracle.com/licenses/upl and Apache License
+// 2.0 as shown at http://www.apache.org/licenses/LICENSE-2.0. You may choose
+// either license.
+//
+// If you elect to accept the software under the Apache License, Version 2.0,
+// the following applies:
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//-----------------------------------------------------------------------------
+'use strict';
+
+const { AsyncLocalStorage } = require('async_hooks');
+const errors = require('./errors.js');
+
+const asyncLocalStorage = new AsyncLocalStorage();
+// One driver-wide invocation hook dispatches every supported operation. It
+// does not hold security configuration: applyForOperation() selects the
+// provider from the individual connection, so pools may use different
+// providers concurrently.
+let invocationHook = null;
+
+//---------------------------------------------------------------------------
+// getInvocationHook()
+//---------------------------------------------------------------------------
+function getInvocationHook() {
+  return invocationHook;
+}
+
+//---------------------------------------------------------------------------
+// setInvocationHook()
+//---------------------------------------------------------------------------
+function setInvocationHook(hook) {
+  invocationHook = hook;
+}
+
+//---------------------------------------------------------------------------
+// _getProvider()
+//
+// Determines the provider associated with the supplied connection.
+//---------------------------------------------------------------------------
+function _getProvider(connection) {
+  // A token configuration hook attaches a provider to an individual pool or
+  // standalone connection. This permits multiple pools to use different
+  // identity providers in the same process without process-global state.
+  return connection?._securityContextProvider;
+}
+
+//---------------------------------------------------------------------------
+// _clearConnection()
+//
+// Clears cached security context for the provided connection.
+//---------------------------------------------------------------------------
+function _clearConnection(connection) {
+  connection.clearEndUserSecurityContext();
+}
+
+//---------------------------------------------------------------------------
+// getCurrentContext()
+//
+// Returns the current context stored in AsyncLocalStorage.
+//---------------------------------------------------------------------------
+function getCurrentContext() {
+  return asyncLocalStorage.getStore()?.metadata ?? null;
+}
+
+//---------------------------------------------------------------------------
+// _getScopedValue() / _setScopedValue()
+//
+// Internal per-runWithContext() scratch storage; it never holds application
+// metadata. The built-in provider uses it to cache an encoded EUSC in
+// operation resolution. Values are keyed by provider because one scope may
+// use connections from differently configured pools. The Map is fresh for
+// every scope and is released with that asynchronous scope.
+//---------------------------------------------------------------------------
+function _getScopedValue(key) {
+  return asyncLocalStorage.getStore()?.values.get(key);
+}
+
+function _setScopedValue(key, value) {
+  const scope = asyncLocalStorage.getStore();
+  if (scope) {
+    scope.values.set(key, value);
+  }
+}
+
+//---------------------------------------------------------------------------
+// applyForOperation()
+//
+// Invokes the registered provider before the supplied database operation. A
+// provider returns a ready-to-apply EndUserSecurityContext, or undefined when
+// this operation should use the normal database login.
+//---------------------------------------------------------------------------
+async function applyForOperation(connection) {
+  const provider = _getProvider(connection);
+  if (!provider) {
+    return;
+  }
+  const perOperation = provider._contextResolution === 'operation';
+  if (!perOperation && connection._securityContextInitialized) {
+    return;
+  }
+  let securityContext;
+  try {
+    securityContext = await provider();
+  } catch (err) {
+    const error = errors.getErr(errors.ERR_END_USER_SECURITY_CONTEXT_PROVIDER);
+    error.cause = err;
+    throw error;
+  }
+
+  if (securityContext) {
+    connection.setEndUserSecurityContext(securityContext);
+  }
+  if (!perOperation) {
+    // The implementation already owns the installed context. Keep only the
+    // fact that this borrowed connection has resolved its provider.
+    connection._securityContextInitialized = true;
+  } else if (securityContext) {
+    return { connection };
+  }
+}
+
+//---------------------------------------------------------------------------
+// _validateContext()
+//
+// Security metadata is an object assembled by the application. Token syntax is
+// deliberately not validated here; the configured identity provider remains
+// authoritative for token validation and exchange.
+//---------------------------------------------------------------------------
+function _validateContext(context) {
+  if (context === null || typeof context !== 'object' || Array.isArray(context)) {
+    errors.throwErr(errors.ERR_INVALID_SECURITY_CONTEXT_METADATA);
+  }
+  const hasEndUserToken = context.endUserToken !== undefined &&
+    context.endUserToken !== null;
+  const hasEndUserName = context.endUserName !== undefined &&
+    context.endUserName !== null;
+  const hasKey = context.key !== undefined && context.key !== null;
+  // These fields represent mutually exclusive EUSC identity forms. Validate
+  // them before entering the callback so a conflicting request cannot perform
+  // unrelated work or reach a database operation before being rejected.
+  if (hasEndUserToken && (hasEndUserName || hasKey)) {
+    errors.throwErr(errors.ERR_CONFLICTING_SECURITY_CONTEXT_IDENTITIES);
+  }
+}
+
+//---------------------------------------------------------------------------
+// runWithContext()
+//
+// Associates the supplied metadata object with the callback's asynchronous
+// work. Applications must treat the metadata object, including nested values, as
+// immutable until the callback and all its database operations complete. The
+// separate Map is mutable driver-only scratch storage, not a copy of metadata.
+//---------------------------------------------------------------------------
+function runWithContext(context, fn, ...args) {
+  _validateContext(context);
+  if (typeof fn !== 'function') {
+    errors.throwErr(errors.ERR_INVALID_SECURITY_CONTEXT_CALLBACK);
+  }
+  return asyncLocalStorage.run({ metadata: context, values: new Map() },
+    () => fn(...args));
+}
+
+//---------------------------------------------------------------------------
+function createInvocationHook() {
+  return {
+    before: async ({ connection }) => {
+      if (!connection) {
+        return undefined;
+      }
+      return await applyForOperation(connection);
+    },
+    after: (state) => {
+      if (state?.connection) {
+        _clearConnection(state.connection);
+      }
+    }
+  };
+}
+
+module.exports = {
+  applyForOperation,
+  runWithContext,
+  getCurrentContext,
+  _getScopedValue,
+  _setScopedValue,
+  getInvocationHook,
+  setInvocationHook,
+  createInvocationHook
+};

package/lib/thin/aq.js

@@ -1,4 +1,4 @@
-// Copyright (c) 2025, Oracle and/or its affiliates.
+// Copyright (c) 2025, 2026, Oracle and/or its affiliates.
 
 //-----------------------------------------------------------------------------
 //
@@ -354,7 +354,6 @@ class ThinMsgPropsImpl {
     this.recipients = [];
     this.numAttempts = 0;
     this.deliveryMode = 0;
-    this.enqTime = null;
     this.msgId = null;
     this.state = 0;
     this.payload = null;
@@ -472,4 +471,4 @@ class ThinMsgPropsImpl {
 
 }
 
-module.exports = { ThinQueueImpl };
+module.exports = { ThinQueueImpl, ThinMsgPropsImpl };