outlet-orm 2.5.0 → 3.1.0

package/src/DatabaseConnection.js

@@ -3,9 +3,50 @@ require('dotenv').config();
 
 // Lazy driver holders
 let mysql;
-let PgClient;
+let PgPool;
 let sqlite3;
 
+// Query log storage
+let queryLog = [];
+let queryLoggingEnabled = false;
+
+/**
+ * Sanitize SQL identifier (table/column name) to prevent SQL injection
+ * @param {string} identifier
+ * @returns {string}
+ */
+function sanitizeIdentifier(identifier) {
+  if (!identifier || typeof identifier !== 'string') {
+    throw new Error('Invalid SQL identifier');
+  }
+  // Allow only alphanumeric, underscore, dot (for table.column)
+  if (!/^[a-zA-Z_][a-zA-Z0-9_]*(\.[a-zA-Z_][a-zA-Z0-9_]*)?$/.test(identifier)) {
+    // Check for common SQL injection patterns
+    // Note: Escape hyphen in character class to avoid range interpretation
+    if (/['";]|--|\/*|\*\/|xp_|sp_|0x/i.test(identifier)) {
+      throw new Error(`Potentially dangerous SQL identifier: ${identifier}`);
+    }
+  }
+  return identifier;
+}
+
+/**
+ * Log a query if logging is enabled
+ * @param {string} sql
+ * @param {Array} params
+ * @param {number} duration
+ */
+function logQuery(sql, params, duration) {
+  if (queryLoggingEnabled) {
+    queryLog.push({
+      sql,
+      params: params || [],
+      duration,
+      timestamp: new Date()
+    });
+  }
+}
+
 function ensureDriver(driverName) {
   let pkg;
   try {
@@ -17,7 +58,7 @@ function ensureDriver(driverName) {
     case 'postgres':
     case 'postgresql':
       pkg = 'pg';
-      if (!PgClient) ({ Client: PgClient } = require('pg'));
+      if (!PgPool) ({ Pool: PgPool } = require('pg'));
       return true;
     case 'sqlite':
       pkg = 'sqlite3';
@@ -40,6 +81,7 @@ function coerceNumber(val) {
 /**
  * Database Connection Manager
  * Supports MySQL, PostgreSQL, and SQLite
+ * Features: Connection pooling, transactions, query logging
  */
 class DatabaseConnection {
   constructor(config) {
@@ -56,7 +98,7 @@ class DatabaseConnection {
       user: cfg.user || env.DB_USER || env.DB_USERNAME,
       password: cfg.password || env.DB_PASSWORD,
       database: cfg.database || env.DB_DATABASE || env.DB_NAME,
-      connectionLimit: cfg.connectionLimit || coerceNumber(env.DB_POOL_MAX)
+      connectionLimit: cfg.connectionLimit || coerceNumber(env.DB_POOL_MAX) || 10
     };
 
     if (driver === 'sqlite' && !resolved.database) {
@@ -67,14 +109,61 @@ class DatabaseConnection {
     this.driver = driver || 'mysql';
     this.connection = null;
     this.pool = null;
+    this._transactionConnection = null;
   }
 
+  // ==================== Query Logging ====================
+
+  /**
+   * Enable query logging
+   * @static
+   */
+  static enableQueryLog() {
+    queryLoggingEnabled = true;
+  }
+
+  /**
+   * Disable query logging
+   * @static
+   */
+  static disableQueryLog() {
+    queryLoggingEnabled = false;
+  }
+
+  /**
+   * Get the query log
+   * @static
+   * @returns {Array}
+   */
+  static getQueryLog() {
+    return [...queryLog];
+  }
+
+  /**
+   * Clear the query log
+   * @static
+   */
+  static flushQueryLog() {
+    queryLog = [];
+  }
+
+  /**
+   * Check if query logging is enabled
+   * @static
+   * @returns {boolean}
+   */
+  static isLogging() {
+    return queryLoggingEnabled;
+  }
+
+  // ==================== Connection ====================
+
   /**
    * Connect to the database
    * @returns {Promise<void>}
    */
   async connect() {
-    if (this.connection) return;
+    if (this.pool || this.connection) return;
 
     switch (this.driver) {
     case 'mysql':
@@ -96,7 +185,7 @@ class DatabaseConnection {
   }
 
   /**
-   * Connect to MySQL database
+   * Connect to MySQL database with connection pool
    * @private
    */
   async connectMySQL() {
@@ -107,24 +196,24 @@ class DatabaseConnection {
       password: this.config.password,
       database: this.config.database,
       waitForConnections: true,
-      connectionLimit: this.config.connectionLimit || 10,
+      connectionLimit: this.config.connectionLimit,
       queueLimit: 0
     });
   }
 
   /**
-   * Connect to PostgreSQL database
+   * Connect to PostgreSQL database with connection pool
    * @private
    */
   async connectPostgreSQL() {
-    this.connection = new PgClient({
+    this.pool = new PgPool({
       host: this.config.host || 'localhost',
       port: this.config.port || 5432,
       user: this.config.user,
       password: this.config.password,
-      database: this.config.database
+      database: this.config.database,
+      max: this.config.connectionLimit
     });
-    await this.connection.connect();
   }
 
   /**
@@ -143,6 +232,133 @@ class DatabaseConnection {
     });
   }
 
+  // ==================== Transactions ====================
+
+  /**
+   * Begin a transaction
+   * @returns {Promise<void>}
+   */
+  async beginTransaction() {
+    await this.connect();
+
+    switch (this.driver) {
+    case 'mysql':
+      this._transactionConnection = await this.pool.getConnection();
+      await this._transactionConnection.beginTransaction();
+      break;
+
+    case 'postgres':
+    case 'postgresql':
+      this._transactionConnection = await this.pool.connect();
+      await this._transactionConnection.query('BEGIN');
+      break;
+
+    case 'sqlite':
+      await new Promise((resolve, reject) => {
+        this.connection.run('BEGIN TRANSACTION', (err) => {
+          if (err) reject(new Error(err.message || String(err)));
+          else resolve();
+        });
+      });
+      break;
+    }
+  }
+
+  /**
+   * Commit the current transaction
+   * @returns {Promise<void>}
+   */
+  async commit() {
+    switch (this.driver) {
+    case 'mysql':
+      if (this._transactionConnection) {
+        await this._transactionConnection.commit();
+        this._transactionConnection.release();
+        this._transactionConnection = null;
+      }
+      break;
+
+    case 'postgres':
+    case 'postgresql':
+      if (this._transactionConnection) {
+        await this._transactionConnection.query('COMMIT');
+        this._transactionConnection.release();
+        this._transactionConnection = null;
+      }
+      break;
+
+    case 'sqlite':
+      await new Promise((resolve, reject) => {
+        this.connection.run('COMMIT', (err) => {
+          if (err) reject(new Error(err.message || String(err)));
+          else resolve();
+        });
+      });
+      break;
+    }
+  }
+
+  /**
+   * Rollback the current transaction
+   * @returns {Promise<void>}
+   */
+  async rollback() {
+    switch (this.driver) {
+    case 'mysql':
+      if (this._transactionConnection) {
+        await this._transactionConnection.rollback();
+        this._transactionConnection.release();
+        this._transactionConnection = null;
+      }
+      break;
+
+    case 'postgres':
+    case 'postgresql':
+      if (this._transactionConnection) {
+        await this._transactionConnection.query('ROLLBACK');
+        this._transactionConnection.release();
+        this._transactionConnection = null;
+      }
+      break;
+
+    case 'sqlite':
+      await new Promise((resolve, reject) => {
+        this.connection.run('ROLLBACK', (err) => {
+          if (err) reject(new Error(err.message || String(err)));
+          else resolve();
+        });
+      });
+      break;
+    }
+  }
+
+  /**
+   * Execute a callback within a transaction
+   * @param {Function} callback - Async function to execute
+   * @returns {Promise<any>} - Result of the callback
+   */
+  async transaction(callback) {
+    await this.beginTransaction();
+    try {
+      const result = await callback(this);
+      await this.commit();
+      return result;
+    } catch (error) {
+      await this.rollback();
+      throw error;
+    }
+  }
+
+  // ==================== Query Methods ====================
+
+  /**
+   * Get the connection to use (transaction connection or pool)
+   * @private
+   */
+  _getConnection() {
+    return this._transactionConnection || this.pool || this.connection;
+  }
+
   /**
    * Execute a SELECT query
    * @param {string} table
@@ -151,18 +367,26 @@ class DatabaseConnection {
    */
   async select(table, query) {
     await this.connect();
+    const safeTable = sanitizeIdentifier(table);
+    const { sql, params } = this.buildSelectQuery(safeTable, query);
+    const start = Date.now();
 
-    const { sql, params } = this.buildSelectQuery(table, query);
-
+    let result;
     switch (this.driver) {
     case 'mysql':
-      return this.executeMySQLQuery(sql, params);
+      result = await this.executeMySQLQuery(sql, params);
+      break;
     case 'postgres':
     case 'postgresql':
-      return this.executePostgreSQLQuery(sql, params);
+      result = await this.executePostgreSQLQuery(sql, params);
+      break;
     case 'sqlite':
-      return this.executeSQLiteQuery(sql, params);
+      result = await this.executeSQLiteQuery(sql, params);
+      break;
     }
+
+    logQuery(sql, params, Date.now() - start);
+    return result;
   }
 
   /**
@@ -173,36 +397,47 @@ class DatabaseConnection {
    */
   async insert(table, data) {
     await this.connect();
+    const safeTable = sanitizeIdentifier(table);
 
-    const columns = Object.keys(data);
+    const columns = Object.keys(data).map(col => sanitizeIdentifier(col));
     const values = Object.values(data);
     const placeholders = this.getPlaceholders(values.length);
 
-    const sql = `INSERT INTO ${table} (${columns.join(', ')}) VALUES (${placeholders})`;
+    const sql = `INSERT INTO ${safeTable} (${columns.join(', ')}) VALUES (${placeholders})`;
+    const start = Date.now();
 
+    let result;
     switch (this.driver) {
     case 'mysql': {
-      const [result] = await this.pool.execute(sql, values);
-      return { insertId: result.insertId, affectedRows: result.affectedRows };
+      const conn = this._getConnection();
+      const [res] = await conn.execute(sql, values);
+      result = { insertId: res.insertId, affectedRows: res.affectedRows };
+      break;
     }
 
     case 'postgres':
     case 'postgresql': {
-      const pgResult = await this.connection.query(
-        `${sql} RETURNING *`,
+      const conn = this._getConnection();
+      const pgResult = await conn.query(
+        `${this.convertToDriverPlaceholder(sql)} RETURNING *`,
         values
       );
-      return { insertId: pgResult.rows[0].id, affectedRows: pgResult.rowCount };
+      result = { insertId: pgResult.rows[0]?.id, affectedRows: pgResult.rowCount };
+      break;
     }
 
     case 'sqlite':
-      return new Promise((resolve, reject) => {
+      result = await new Promise((resolve, reject) => {
         this.connection.run(sql, values, function(err) {
           if (err) reject(new Error(err.message || String(err)));
           else resolve({ insertId: this.lastID, affectedRows: this.changes });
         });
       });
+      break;
     }
+
+    logQuery(sql, values, Date.now() - start);
+    return result;
   }
 
   /**
@@ -215,36 +450,47 @@ class DatabaseConnection {
     if (data.length === 0) return { affectedRows: 0 };
 
     await this.connect();
+    const safeTable = sanitizeIdentifier(table);
 
-    const columns = Object.keys(data[0]);
+    const columns = Object.keys(data[0]).map(col => sanitizeIdentifier(col));
     const valuesSets = data.map(row => Object.values(row));
 
     const placeholderSet = `(${this.getPlaceholders(columns.length)})`;
     const allPlaceholders = valuesSets.map(() => placeholderSet).join(', ');
     const allValues = valuesSets.flat();
 
-    const sql = `INSERT INTO ${table} (${columns.join(', ')}) VALUES ${allPlaceholders}`;
+    const sql = `INSERT INTO ${safeTable} (${columns.join(', ')}) VALUES ${allPlaceholders}`;
+    const start = Date.now();
 
+    let result;
     switch (this.driver) {
     case 'mysql': {
-      const [result] = await this.pool.execute(sql, allValues);
-      return { affectedRows: result.affectedRows };
+      const conn = this._getConnection();
+      const [res] = await conn.execute(sql, allValues);
+      result = { affectedRows: res.affectedRows };
+      break;
     }
 
     case 'postgres':
     case 'postgresql': {
-      const pgResult = await this.connection.query(sql, allValues);
-      return { affectedRows: pgResult.rowCount };
+      const conn = this._getConnection();
+      const pgResult = await conn.query(this.convertToDriverPlaceholder(sql), allValues);
+      result = { affectedRows: pgResult.rowCount };
+      break;
     }
 
     case 'sqlite':
-      return new Promise((resolve, reject) => {
+      result = await new Promise((resolve, reject) => {
         this.connection.run(sql, allValues, function(err) {
           if (err) reject(new Error(err.message || String(err)));
           else resolve({ affectedRows: this.changes });
         });
       });
+      break;
     }
+
+    logQuery(sql, allValues, Date.now() - start);
+    return result;
   }
 
   /**
@@ -256,39 +502,50 @@ class DatabaseConnection {
    */
   async update(table, data, query) {
     await this.connect();
+    const safeTable = sanitizeIdentifier(table);
 
-    const setClauses = Object.keys(data).map(key => `${key} = ?`);
+    const setClauses = Object.keys(data).map(key => `${sanitizeIdentifier(key)} = ?`);
     const { whereClause, params: whereParams } = this.buildWhereClause(query.wheres || []);
 
-    const sql = `UPDATE ${table} SET ${setClauses.join(', ')}${whereClause}`;
+    const sql = `UPDATE ${safeTable} SET ${setClauses.join(', ')}${whereClause}`;
     const params = [...Object.values(data), ...whereParams];
+    const start = Date.now();
 
+    let result;
     switch (this.driver) {
     case 'mysql': {
-      const [result] = await this.pool.execute(
+      const conn = this._getConnection();
+      const [res] = await conn.execute(
         this.convertToDriverPlaceholder(sql),
         params
       );
-      return { affectedRows: result.affectedRows };
+      result = { affectedRows: res.affectedRows };
+      break;
     }
 
     case 'postgres':
     case 'postgresql': {
-      const pgResult = await this.connection.query(
+      const conn = this._getConnection();
+      const pgResult = await conn.query(
         this.convertToDriverPlaceholder(sql, 'postgres'),
         params
       );
-      return { affectedRows: pgResult.rowCount };
+      result = { affectedRows: pgResult.rowCount };
+      break;
     }
 
     case 'sqlite':
-      return new Promise((resolve, reject) => {
+      result = await new Promise((resolve, reject) => {
         this.connection.run(sql, params, function(err) {
           if (err) reject(new Error(err.message || String(err)));
           else resolve({ affectedRows: this.changes });
         });
       });
+      break;
     }
+
+    logQuery(sql, params, Date.now() - start);
+    return result;
   }
 
   /**
@@ -299,106 +556,141 @@ class DatabaseConnection {
    */
   async delete(table, query) {
     await this.connect();
+    const safeTable = sanitizeIdentifier(table);
 
     const { whereClause, params } = this.buildWhereClause(query.wheres || []);
-    const sql = `DELETE FROM ${table}${whereClause}`;
+    const sql = `DELETE FROM ${safeTable}${whereClause}`;
+    const start = Date.now();
 
+    let result;
     switch (this.driver) {
     case 'mysql': {
-      const [result] = await this.pool.execute(
+      const conn = this._getConnection();
+      const [res] = await conn.execute(
         this.convertToDriverPlaceholder(sql),
         params
       );
-      return { affectedRows: result.affectedRows };
+      result = { affectedRows: res.affectedRows };
+      break;
     }
 
     case 'postgres':
     case 'postgresql': {
-      const pgResult = await this.connection.query(
+      const conn = this._getConnection();
+      const pgResult = await conn.query(
         this.convertToDriverPlaceholder(sql, 'postgres'),
         params
       );
-      return { affectedRows: pgResult.rowCount };
+      result = { affectedRows: pgResult.rowCount };
+      break;
     }
 
     case 'sqlite':
-      return new Promise((resolve, reject) => {
+      result = await new Promise((resolve, reject) => {
         this.connection.run(sql, params, function(err) {
           if (err) reject(new Error(err.message || String(err)));
           else resolve({ affectedRows: this.changes });
         });
       });
+      break;
     }
+
+    logQuery(sql, params, Date.now() - start);
+    return result;
   }
 
   /**
    * Atomically increment a column
    * @param {string} table
    * @param {string} column
-   * @param {number} amount
    * @param {Object} query
+   * @param {number} amount
    * @returns {Promise<{affectedRows: number}>}
    */
   async increment(table, column, query, amount = 1) {
     await this.connect();
+    const safeTable = sanitizeIdentifier(table);
+    const safeColumn = sanitizeIdentifier(column);
 
     const { whereClause, params: whereParams } = this.buildWhereClause(query?.wheres || []);
-    const sql = `UPDATE ${table} SET ${column} = ${column} + ?${whereClause}`;
+    const sql = `UPDATE ${safeTable} SET ${safeColumn} = ${safeColumn} + ?${whereClause}`;
     const params = [amount, ...whereParams];
+    const start = Date.now();
 
+    let result;
     switch (this.driver) {
     case 'mysql': {
-      const [result] = await this.pool.execute(this.convertToDriverPlaceholder(sql), params);
-      return { affectedRows: result.affectedRows };
+      const conn = this._getConnection();
+      const [res] = await conn.execute(this.convertToDriverPlaceholder(sql), params);
+      result = { affectedRows: res.affectedRows };
+      break;
     }
     case 'postgres':
     case 'postgresql': {
-      const res = await this.connection.query(this.convertToDriverPlaceholder(sql, 'postgres'), params);
-      return { affectedRows: res.rowCount };
+      const conn = this._getConnection();
+      const res = await conn.query(this.convertToDriverPlaceholder(sql, 'postgres'), params);
+      result = { affectedRows: res.rowCount };
+      break;
     }
     case 'sqlite':
-      return new Promise((resolve, reject) => {
+      result = await new Promise((resolve, reject) => {
         this.connection.run(sql, params, function(err) {
           if (err) reject(new Error(err.message || String(err)));
           else resolve({ affectedRows: this.changes });
         });
       });
+      break;
     }
+
+    logQuery(sql, params, Date.now() - start);
+    return result;
   }
 
   /**
    * Atomically decrement a column
    * @param {string} table
    * @param {string} column
-   * @param {number} amount
    * @param {Object} query
+   * @param {number} amount
    * @returns {Promise<{affectedRows: number}>}
    */
   async decrement(table, column, query, amount = 1) {
     await this.connect();
+    const safeTable = sanitizeIdentifier(table);
+    const safeColumn = sanitizeIdentifier(column);
 
     const { whereClause, params: whereParams } = this.buildWhereClause(query?.wheres || []);
-    const sql = `UPDATE ${table} SET ${column} = ${column} - ?${whereClause}`;
+    const sql = `UPDATE ${safeTable} SET ${safeColumn} = ${safeColumn} - ?${whereClause}`;
     const params = [amount, ...whereParams];
+    const start = Date.now();
 
+    let result;
     switch (this.driver) {
     case 'mysql': {
-      const [result] = await this.pool.execute(this.convertToDriverPlaceholder(sql), params);
-      return { affectedRows: result.affectedRows };
+      const conn = this._getConnection();
+      const [res] = await conn.execute(this.convertToDriverPlaceholder(sql), params);
+      result = { affectedRows: res.affectedRows };
+      break;
     }
     case 'postgres':
     case 'postgresql': {
-      const res = await this.connection.query(this.convertToDriverPlaceholder(sql, 'postgres'), params);
-      return { affectedRows: res.rowCount };
+      const conn = this._getConnection();
+      const res = await conn.query(this.convertToDriverPlaceholder(sql, 'postgres'), params);
+      result = { affectedRows: res.rowCount };
+      break;
     }
     case 'sqlite':
-      return new Promise((resolve, reject) => {
+      result = await new Promise((resolve, reject) => {
         this.connection.run(sql, params, function(err) {
           if (err) reject(new Error(err.message || String(err)));
           else resolve({ affectedRows: this.changes });
         });
       });
+      break;
     }
+
+    logQuery(sql, params, Date.now() - start);
+    return result;
   }
 
   /**
@@ -409,77 +701,128 @@ class DatabaseConnection {
    */
   async count(table, query) {
     await this.connect();
+    const safeTable = sanitizeIdentifier(table);
 
-    const { whereClause, params } = this.buildWhereClause(query.wheres || []);
-    const sql = `SELECT COUNT(*) as count FROM ${table}${whereClause}`;
+    const { whereClause, params } = this.buildWhereClause(query?.wheres || []);
+    const sql = `SELECT COUNT(*) as count FROM ${safeTable}${whereClause}`;
+    const start = Date.now();
 
-    const rows = await this.executeRawQuery(sql, params);
-    return rows[0].count || rows[0].COUNT || 0;
+    let result;
+    switch (this.driver) {
+    case 'mysql': {
+      const conn = this._getConnection();
+      const [rows] = await conn.execute(this.convertToDriverPlaceholder(sql), params);
+      result = rows[0].count;
+      break;
+    }
+    case 'postgres':
+    case 'postgresql': {
+      const conn = this._getConnection();
+      const pgResult = await conn.query(this.convertToDriverPlaceholder(sql, 'postgres'), params);
+      result = parseInt(pgResult.rows[0].count, 10);
+      break;
+    }
+    case 'sqlite':
+      result = await new Promise((resolve, reject) => {
+        this.connection.get(sql, params, (err, row) => {
+          if (err) reject(new Error(err.message || String(err)));
+          else resolve(row.count);
+        });
+      });
+      break;
+    }
+
+    logQuery(sql, params, Date.now() - start);
+    return result;
   }
 
   /**
-   * Execute a raw query
+   * Execute a raw query and return normalized results
    * @param {string} sql
    * @param {Array} params
    * @returns {Promise<Array>}
    */
   async executeRawQuery(sql, params = []) {
     await this.connect();
+    const start = Date.now();
 
+    let result;
     switch (this.driver) {
-    case 'mysql':
-      return this.executeMySQLQuery(sql, params);
+    case 'mysql': {
+      const conn = this._getConnection();
+      const [rows] = await conn.execute(sql, params);
+      result = rows;
+      break;
+    }
     case 'postgres':
-    case 'postgresql':
-      return this.executePostgreSQLQuery(sql, params);
+    case 'postgresql': {
+      const conn = this._getConnection();
+      const pgResult = await conn.query(sql, params);
+      result = pgResult.rows;
+      break;
+    }
     case 'sqlite':
-      return this.executeSQLiteQuery(sql, params);
+      result = await new Promise((resolve, reject) => {
+        this.connection.all(sql, params, (err, rows) => {
+          if (err) reject(new Error(err.message || String(err)));
+          else resolve(rows);
+        });
+      });
+      break;
     }
+
+    logQuery(sql, params, Date.now() - start);
+    return result;
   }
 
   /**
-   * Execute raw SQL and return driver-native results (used by migrations)
+   * Execute raw SQL (driver-native results - for migrations)
    * @param {string} sql
    * @param {Array} params
    * @returns {Promise<any>}
    */
   async execute(sql, params = []) {
     await this.connect();
+    const start = Date.now();
+
+    let result;
     switch (this.driver) {
     case 'mysql': {
-      const [result] = await this.pool.execute(sql, params);
-      return result;
+      const conn = this._getConnection();
+      const [rows] = await conn.execute(sql, params);
+      result = rows;
+      break;
     }
     case 'postgres':
     case 'postgresql': {
-      const res = await this.connection.query(this.convertToDriverPlaceholder(sql, 'postgres'), params);
-      return res.rows ?? res;
+      const conn = this._getConnection();
+      const pgResult = await conn.query(sql, params);
+      result = pgResult.rows;
+      break;
     }
     case 'sqlite':
-      return new Promise((resolve, reject) => {
-        // Choose all/run based on query type
-        const isSelect = /^\s*select/i.test(sql);
-        if (isSelect) {
-          this.connection.all(sql, params, (err, rows) => {
-            if (err) reject(new Error(err.message || String(err)));
-            else resolve(rows);
-          });
-        } else {
-          this.connection.run(sql, params, function(err) {
-            if (err) reject(new Error(err.message || String(err)));
-            else resolve({ changes: this.changes, lastID: this.lastID });
-          });
-        }
+      result = await new Promise((resolve, reject) => {
+        this.connection.all(sql, params, (err, rows) => {
+          if (err) reject(new Error(err.message || String(err)));
+          else resolve(rows || []);
+        });
       });
+      break;
     }
+
+    logQuery(sql, params, Date.now() - start);
+    return result;
   }
 
+  // ==================== Driver-Specific Query Execution ====================
+
   /**
    * Execute MySQL query
    * @private
    */
   async executeMySQLQuery(sql, params) {
-    const [rows] = await this.pool.execute(sql, params);
+    const conn = this._getConnection();
+    const [rows] = await conn.execute(sql, params);
     return rows;
   }
 
@@ -488,7 +831,8 @@ class DatabaseConnection {
    * @private
    */
   async executePostgreSQLQuery(sql, params) {
-    const result = await this.connection.query(
+    const conn = this._getConnection();
+    const result = await conn.query(
       this.convertToDriverPlaceholder(sql, 'postgres'),
       params
     );
@@ -508,35 +852,39 @@ class DatabaseConnection {
     });
   }
 
+  // ==================== Query Building ====================
+
   /**
    * Build SELECT query
    * @private
    */
   buildSelectQuery(table, query) {
-    const distinct = query.distinct ? 'DISTINCT ' : '';
-    const columns = query.columns && query.columns.length > 0
-      ? query.columns.join(', ')
-      : '*';
+    const params = [];
 
-    let sql = `SELECT ${distinct}${columns} FROM ${table}`;
-    // JOINS
-    if (query.joins && query.joins.length > 0) {
-      const joinClauses = query.joins.map(j => {
-        const type = (j.type === 'left' ? 'LEFT JOIN' : 'INNER JOIN');
-        const op = j.operator || '=';
-        return ` ${type} ${j.table} ON ${j.first} ${op} ${j.second}`;
-      }).join('');
-      sql += joinClauses;
+    // SELECT clause
+    let selectClause = '*';
+    if (query.columns && query.columns.length > 0 && query.columns[0] !== '*') {
+      selectClause = query.columns.join(', ');
     }
-    let params = [];
 
-    // WHERE clauses
-    if (query.wheres && query.wheres.length > 0) {
-      const { whereClause, params: whereParams } = this.buildWhereClause(query.wheres);
-      sql += whereClause;
-      params = [...params, ...whereParams];
+    // DISTINCT
+    const distinctClause = query.distinct ? 'DISTINCT ' : '';
+
+    let sql = `SELECT ${distinctClause}${selectClause} FROM ${table}`;
+
+    // JOINs
+    if (query.joins && query.joins.length > 0) {
+      for (const join of query.joins) {
+        const joinType = (join.type || 'inner').toUpperCase();
+        sql += ` ${joinType} JOIN ${join.table} ON ${join.first} ${join.operator} ${join.second}`;
+      }
     }
 
+    // WHERE
+    const { whereClause, params: whereParams } = this.buildWhereClause(query.wheres);
+    sql += whereClause;
+    params.push(...whereParams);
+
     // GROUP BY
     if (query.groupBys && query.groupBys.length > 0) {
       sql += ` GROUP BY ${query.groupBys.join(', ')}`;
@@ -667,14 +1015,20 @@ class DatabaseConnection {
    * @returns {Promise<void>}
    */
   async close() {
+    if (this._transactionConnection) {
+      try {
+        await this.rollback();
+      } catch (e) {
+        // Ignore rollback errors during close
+      }
+    }
+
     if (this.pool) {
       await this.pool.end();
       this.pool = null;
     }
     if (this.connection) {
-      if (this.driver === 'postgres' || this.driver === 'postgresql') {
-        await this.connection.end();
-      } else if (this.driver === 'sqlite') {
+      if (this.driver === 'sqlite') {
         await new Promise((resolve, reject) => {
           this.connection.close((err) => {
             if (err) reject(new Error(err.message || String(err)));