plugin-data-source-mssql 2.0.10 → 2.0.12

package/src/server/data-source/MssqlExternalDataSource.ts

@@ -8,16 +8,21 @@
  */
 
 import { Database } from '@nocobase/database';
-import { SequelizeDataSource, DatabaseIntrospector } from '@nocobase/data-source-manager';
+import { SequelizeDataSource } from '@nocobase/data-source-manager';
+import type { CollectionOptions, LoadedCollections, LoadTablesOptions } from '@nocobase/data-source-manager';
 import { MssqlCollectionManager } from './MssqlCollectionManager';
 import { MssqlIntrospector } from './MssqlIntrospector';
 import type { Context } from '@nocobase/actions';
 import { Op, literal, type Dialect } from 'sequelize';
 import fs from 'fs';
 import path from 'path';
+import { formatDateTimeParameter, quoteIdentifier, quoteUnicodeStringLiteral } from '../security/sql-quote';
 
+// Escape the LIKE wildcard chars (% and _) plus the escape char itself (\) so a literal
+// backslash in user input is not misparsed as escaping the following char. Order matters:
+// escape the escape character first.
 function escapeLike(value: string) {
-  return value.replace(/[_%]/g, '\\$&');
+  return value.replace(/[\\_%]/g, '\\$&');
 }
 
 const MSSQL_DRIVER_NAME = 'tedious';
@@ -64,13 +69,14 @@ const resolveMssqlDriverPath = () => {
     const resolved = require.resolve(MSSQL_DRIVER_NAME);
     return resolved;
   } catch (error) {
-    console.error(`[MSSQL] Failed to resolve tedious driver. Error: ${error.message}`);
+    const message = error instanceof Error ? error.message : String(error);
+    process.stderr.write(`[MSSQL] Failed to resolve tedious driver. Error: ${message}\n`);
   }
 
   return undefined;
 };
 
-const formatDatabaseOptions = (options: MssqlDataSourceOptions = {}) => {
+export const formatDatabaseOptions = (options: MssqlDataSourceOptions = {}) => {
   const {
     host,
     port,
@@ -93,9 +99,15 @@ const formatDatabaseOptions = (options: MssqlDataSourceOptions = {}) => {
   const mergedDialectOptions = {
     ...(dialectOptions || {}),
     options: {
+      // enableArithAbort: ON is the recommended SQL Server session setting. Leaving it
+      // OFF (tedious default) makes the optimizer treat indexed computed columns /
+      // indexed views as unusable and can cause inconsistent behavior for parametrized
+      // queries. A user-supplied dialectOptions.options.enableArithAbort still wins.
+      enableArithAbort: true,
       ...(dialectOptions?.options || {}),
       ...(encrypt === undefined ? {} : { encrypt }),
-      // Use UTC to avoid timezone offset format issues with DATETIME columns
+      // useUTC is intentionally forced ON (placed after the user options spread so it cannot be
+      // overridden): disabling it reintroduces timezone-offset format errors on DATETIME columns.
       useUTC: true,
       // Timeout tuning: tedious defaults to 15s which is too low for large tables
       requestTimeout: dialectOptions?.options?.requestTimeout ?? 120000, // 2 min (default: 15s)
@@ -155,6 +167,8 @@ export type MssqlDataSourceOptions = {
   name?: string;
   cache?: any;
   storagePath?: string;
+  addAllCollections?: boolean;
+  selectedCollections?: string[];
 };
 
 export class MssqlExternalDataSource extends SequelizeDataSource<MssqlIntrospector> {
@@ -209,14 +223,15 @@ export class MssqlExternalDataSource extends SequelizeDataSource<MssqlIntrospect
 
     /**
      * Build a safe CONTAINS() literal.
-     * The column name comes from the model definition (not user input) so bracket-quoting is safe.
-     * The search value is escaped via sequelize.escape() to prevent SQL injection.
+     * The column name is bracket-quoted via quoteIdentifier (escaping embedded `]` so a crafted
+     * column name cannot terminate the identifier), and the search value is rendered as a
+     * Unicode string literal (N'...') so a quote in it cannot break out of the CONTAINS term.
      */
     const buildContains = (fieldName: string, tableName: string, value: string, negate = false) => {
       // Use prefix search (*) for intuitive search feel; wrap in double-quotes and escape internal quotes
       const ftsValue = '"' + value.trim().replace(/"/g, '""') + '*"';
-      const escapedFts = db.sequelize.escape(ftsValue);
-      const expr = `CONTAINS([${fieldName}], ${escapedFts})`;
+      const escapedFts = quoteUnicodeStringLiteral(ftsValue);
+      const expr = `CONTAINS(${quoteIdentifier(fieldName)}, ${escapedFts})`;
       return literal(negate ? `NOT (${expr})` : expr);
     };
 
@@ -308,8 +323,9 @@ export class MssqlExternalDataSource extends SequelizeDataSource<MssqlIntrospect
         }
 
         if (dateValue && !isNaN(dateValue.getTime())) {
-          // Format: 'YYYY-MM-DD HH:mm:ss.SSS' — MSSQL native datetime format
-          instance.dataValues[key] = dateValue.toISOString().replace('T', ' ').replace('Z', '');
+          // Format: 'YYYY-MM-DD HH:mm:ss.SSS[SSSS]' — MSSQL native datetime format, preserving
+          // sub-millisecond precision from tedious's nanosecondsDelta when present.
+          instance.dataValues[key] = formatDateTimeParameter(dateValue);
         }
       }
     });
@@ -320,7 +336,7 @@ export class MssqlExternalDataSource extends SequelizeDataSource<MssqlIntrospect
    * This method is called by the core framework with `localData` populated from
    * the `dataSourcesCollections` / `dataSourcesFields` tables.
    */
-  async load(options: any = {}) {
+  async load(options: { localData?: LoadedCollections } = {}) {
     const { localData = {} } = options;
 
     // Authenticate connection
@@ -341,18 +357,32 @@ export class MssqlExternalDataSource extends SequelizeDataSource<MssqlIntrospect
 
     // Introspect tables from the external database
     try {
-      const tables = await this.introspector.getTables();
-      this.logger?.info?.(`[MSSQL] Found ${tables.length} tables in database`);
+      const dataSourceOptions = this.options as MssqlDataSourceOptions;
+      // Existing sources may have addAllCollections=false without a stored selection: the previous
+      // implementation ignored that flag, so keep loading all tables until a selection is saved.
+      const selectedTables =
+        dataSourceOptions.addAllCollections === false && Array.isArray(dataSourceOptions.selectedCollections)
+          ? [...new Set(dataSourceOptions.selectedCollections.filter((name) => typeof name === 'string' && name))]
+          : undefined;
+      const tables = selectedTables ?? (await this.introspector.getTables());
+      this.logger?.info?.(`[MSSQL] Loading ${tables.length} tables in database`);
 
       const schema = this.collectionManager.db.options.schema || 'dbo';
       const total = tables.length;
       let loaded = 0;
 
-      // Pre-load all primary key info in one query before parallel introspection
-      await (this.introspector as MssqlIntrospector).preloadAllPrimaryKeys(schema);
+      // Pre-load all column metadata + primary keys in one bulk query each before the
+      // parallel introspection loop, so per-table describeTable()/sys.indexes calls are
+      // served from memory (anti-N+1).
+      if (!selectedTables) {
+        await this.introspector.preloadAllColumns(schema);
+        await this.introspector.preloadAllPrimaryKeys(schema);
+      }
 
       // Pre-load FTS index info, then register smart text operators (CONTAINS vs LIKE routing)
-      await (this.introspector as MssqlIntrospector).preloadFTSIndexedColumns(schema);
+      if (tables.length) {
+        await this.introspector.preloadFTSIndexedColumns(schema, selectedTables);
+      }
       this.registerMssqlTextOperators();
 
       // Parallelize introspection in batches to avoid connection pool exhaustion
@@ -364,10 +394,12 @@ export class MssqlExternalDataSource extends SequelizeDataSource<MssqlIntrospect
           batch.map(async (tableName) => {
             const tableInfo = { tableName, schema };
             try {
-              const collectionOptions = await this.introspector.getCollection({
+              const name = this.introspector.tableInfoToCollectionOptions(tableInfo).name;
+              const introspected = await this.introspector.getCollection({
                 tableInfo,
-                localOptions: localData[tableName] || {},
+                localOptions: localData[name] || localData[tableName] || {},
               });
+              const [collectionOptions] = this.mergeWithLoadedCollections([introspected], localData);
 
               collectionOptions.introspected = true;
               collectionOptions.repository = 'mssql-repo';
@@ -406,12 +438,35 @@ export class MssqlExternalDataSource extends SequelizeDataSource<MssqlIntrospect
    * Called by the core framework's loadDataSourceTablesIntoCollections middleware
    * when creating/updating a data source with selected tables.
    *
-   * This method persists selected tables to the `dataSourcesCollections` table
-   * via the middleware pipeline.
+   * The middleware persists the selected table names in the data source options.
    */
-  async loadTables(ctx: Context, tables: string[]): Promise<any> {
-    this.logger?.info?.(`[MSSQL] Loading ${tables.length} specific tables:`, tables);
+  async loadTables(ctx: Context, tables: string[] = [], options: LoadTablesOptions = {}): Promise<void> {
+    // The core middleware removes values.collections after this call. Persist the selection
+    // in the datasource options so it is available to load() after create, update, or restart.
+    const { resourceName, actionName, params } = ctx.action || {};
+    if (resourceName === 'dataSources' && (actionName === 'create' || actionName === 'update')) {
+      const values = params.values;
+      const addAllCollections = values?.addAllCollections ?? values?.options?.addAllCollections;
+      if (addAllCollections === false && Array.isArray(params.values?.collections)) {
+        values.options = {
+          ...values.options,
+          addAllCollections: false,
+          selectedCollections: [
+            ...new Set(tables.filter((name): name is string => typeof name === 'string' && name.length > 0)),
+          ],
+        };
+      }
+    }
 
+    const collections = await this.prepareTables(tables, options.localData);
+    for (const collection of collections) {
+      this.collectionManager.defineCollection(collection);
+    }
+  }
+
+  async prepareTables(tables: string[], localData: LoadedCollections = {}): Promise<CollectionOptions[]> {
+    const collections: CollectionOptions[] = [];
+    this.logger?.info?.(`[MSSQL] Loading ${tables.length} specific tables:`, tables);
     for (const tableName of tables) {
       const tableInfo = {
         tableName,
@@ -419,25 +474,31 @@ export class MssqlExternalDataSource extends SequelizeDataSource<MssqlIntrospect
       };
 
       try {
-        const collectionOptions = await this.introspector.getCollection({ tableInfo });
+        const name = this.introspector.tableInfoToCollectionOptions(tableInfo).name;
+        const introspected = await this.introspector.getCollection({
+          tableInfo,
+          localOptions: localData[name] || localData[tableName] || {},
+        });
+        const [collectionOptions] = this.mergeWithLoadedCollections([introspected], localData);
         collectionOptions.introspected = true;
         collectionOptions.repository = 'mssql-repo';
         collectionOptions.simplePaginate = true;
 
-        this.collectionManager.defineCollection(collectionOptions);
+        collections.push(collectionOptions);
         this.logger?.debug?.(`[MSSQL] Loaded table ${tableName} as collection`);
       } catch (error) {
         this.logger?.error?.(`[MSSQL] Failed to load table ${tableName}:`, error);
         throw error;
       }
     }
+    return collections;
   }
 
   /**
    * Return public connection options (safe to expose to client).
    */
   publicOptions() {
-    const opts = (this as any).options || {};
+    const opts = (this.options as MssqlDataSourceOptions) || {};
     return {
       host: opts.host,
       port: opts.port,
@@ -446,6 +507,8 @@ export class MssqlExternalDataSource extends SequelizeDataSource<MssqlIntrospect
       schema: opts.schema,
       tablePrefix: opts.tablePrefix,
       encrypt: opts.encrypt,
+      addAllCollections: opts.addAllCollections,
+      selectedCollections: opts.selectedCollections,
       isExternal: true,
       isDBInstance: true,
     };

package/src/server/data-source/MssqlIntrospector.ts

@@ -9,6 +9,14 @@
 
 import { DatabaseIntrospector } from '@nocobase/data-source-manager';
 import { tableInfo } from '@nocobase/data-source-manager';
+import { QueryTypes } from 'sequelize';
+import { quoteIdentifier } from '../security/sql-quote';
+import {
+  buildBulkColumnsSql,
+  groupColumnsByTable,
+  type MssqlBulkColumnRow,
+  type MssqlTableColumns,
+} from './mssql-bulk-introspection';
 
 /**
  * MSSQL field type → NocoBase field type mapping.
@@ -62,6 +70,15 @@ export class MssqlIntrospector extends DatabaseIntrospector {
   /** Cache of { tableName → pk column names[] } loaded by preloadAllPrimaryKeys() */
   private primaryKeyCache: Map<string, string[]> | null = null;
 
+  /**
+   * Cache of { tableName → describeTable-compatible column map } loaded in ONE
+   * schema-wide query by preloadAllColumns(). When present, getTableColumnsInfo()
+   * serves column metadata from memory instead of a per-table describeTable() call,
+   * eliminating the N+1 introspection round trips. null = not preloaded (fall back
+   * to per-table describeTable).
+   */
+  private columnsCache: Map<string, MssqlTableColumns> | null = null;
+
   /**
    * Cache of { tableName → Set<columnName> } for columns with Full-Text Search indexes.
    * null = not yet loaded; empty Map = loaded but no FTS columns found (or FTS not installed).
@@ -106,11 +123,37 @@ export class MssqlIntrospector extends DatabaseIntrospector {
     }
   }
 
+  /**
+   * Load column metadata for ALL tables in the schema in ONE bulk query and cache it.
+   * This is the anti-N+1 path: instead of Sequelize's describeTable() issuing a
+   * per-table `sp_columns`-style round trip, the whole catalog is fetched once and
+   * grouped in memory. Call before the parallel introspection loop; getTableColumnsInfo()
+   * then serves from `columnsCache` and falls back to describeTable() only if the
+   * preload failed.
+   */
+  async preloadAllColumns(schemaName = 'dbo'): Promise<void> {
+    try {
+      const rows = (await this.db.sequelize.query(buildBulkColumnsSql(schemaName), {
+        type: 'SELECT',
+      })) as MssqlBulkColumnRow[];
+
+      this.columnsCache = groupColumnsByTable(rows);
+      this.db.logger.debug(`[MSSQL] Preloaded column metadata for ${this.columnsCache.size} tables`);
+    } catch (err) {
+      this.db.logger.warn('[MSSQL] Failed to bulk-preload columns, will fall back to per-table describeTable:', err);
+      this.columnsCache = null;
+    }
+  }
+
   /**
    * Load Full-Text Search index info for ALL columns in one query and cache the result.
    * Call this once before queries run so that text operators can route to CONTAINS() vs LIKE.
    */
-  async preloadFTSIndexedColumns(schemaName = 'dbo'): Promise<void> {
+  async preloadFTSIndexedColumns(schemaName = 'dbo', tableNames?: string[]): Promise<void> {
+    if (tableNames && !tableNames.length) {
+      this.ftsColumnCache = new Map();
+      return;
+    }
     try {
       const sql = `
         SELECT t.name AS table_name, c.name AS column_name
@@ -119,6 +162,7 @@ export class MssqlIntrospector extends DatabaseIntrospector {
         INNER JOIN sys.tables t ON fic.object_id = t.object_id
         INNER JOIN sys.schemas s ON t.schema_id = s.schema_id
         WHERE s.name = ${this.db.sequelize.escape(schemaName)}
+        ${tableNames ? `AND t.name IN (${tableNames.map((name) => this.db.sequelize.escape(name)).join(', ')})` : ''}
       `;
       const rows = (await this.db.sequelize.query(sql, { type: 'SELECT' })) as any[];
 
@@ -146,22 +190,13 @@ export class MssqlIntrospector extends DatabaseIntrospector {
     return this.ftsColumnCache.get(tableName)?.has(columnName) ?? false;
   }
 
-  /**
-   * Override getTableList to handle MSSQL's object-format table names.
-   * MSSQL's showAllTables() may return {tableName: 'Name', schema: 'dbo'} objects.
-   */
+  /** List only tables in the configured schema; names are relative to that schema. */
   async getTableList(): Promise<string[]> {
-    const tables = await this.db.sequelize.getQueryInterface().showAllTables();
-    return tables.map((table: any) => {
-      if (typeof table === 'string') {
-        return table;
-      }
-      // Object format: {tableName: 'TableName', schema: 'dbo'}
-      if (table && typeof table === 'object') {
-        return table.tableName || table.name || String(Object.values(table).find((v) => typeof v === 'string'));
-      }
-      return String(table);
-    });
+    const rows = await this.db.sequelize.query<{ name: string }>(
+      'SELECT t.name AS name FROM sys.tables t INNER JOIN sys.schemas s ON s.schema_id = t.schema_id WHERE s.name = :schema',
+      { replacements: { schema: this.db.options.schema || 'dbo' }, type: QueryTypes.SELECT },
+    );
+    return rows.map((row) => row.name);
   }
 
   /**
@@ -169,13 +204,20 @@ export class MssqlIntrospector extends DatabaseIntrospector {
    * Adds PK detection fallback via sys.indexes query.
    */
   async getTableColumnsInfo(tableInfo: tableInfo) {
-    const columns = await this.db.sequelize.getQueryInterface().describeTable(tableInfo);
+    const tableName = typeof tableInfo === 'string' ? tableInfo : tableInfo.tableName;
+    const cached = this.columnsCache?.get(tableName);
+
+    // Serve from the bulk-preloaded cache when available (anti-N+1 path); otherwise
+    // fall back to a per-table describeTable() call. Clone the cached map so per-table
+    // PK/default mutations below never leak back into the shared cache.
+    const columns = cached
+      ? (Object.fromEntries(Object.entries(cached).map(([k, v]) => [k, { ...v }])) as typeof cached)
+      : await this.db.sequelize.getQueryInterface().describeTable(tableInfo);
 
     // Check if any column is already marked as PK
     let hasPrimaryKey = Object.values(columns).some((col: any) => col.primaryKey);
 
     if (!hasPrimaryKey) {
-      const tableName = typeof tableInfo === 'string' ? tableInfo : tableInfo.tableName;
       const schemaName = typeof tableInfo === 'string' ? 'dbo' : tableInfo.schema || 'dbo';
       let pkColumns: string[] | undefined;
 
@@ -235,8 +277,12 @@ export class MssqlIntrospector extends DatabaseIntrospector {
    */
   async getTableConstraints(tableInfo: tableInfo) {
     try {
-      const tableName = typeof tableInfo === 'string' ? tableInfo : tableInfo.tableName;
-      return await this.db.sequelize.getQueryInterface().showIndex(tableName);
+      const name = typeof tableInfo === 'string' ? tableInfo : tableInfo.tableName;
+      const schema = typeof tableInfo === 'string' ? this.db.options.schema || 'dbo' : tableInfo.schema || 'dbo';
+      return await this.db.sequelize.query('EXEC sys.sp_helpindex @objname = :name', {
+        replacements: { name: `${quoteIdentifier(schema)}.${quoteIdentifier(name)}` },
+        type: QueryTypes.SHOWINDEXES,
+      });
     } catch (err) {
       // MSSQL may not support showIndex well for all table types
       this.db.logger.warn(
@@ -247,29 +293,12 @@ export class MssqlIntrospector extends DatabaseIntrospector {
     }
   }
 
-  /**
-   * Override to handle MSSQL auto-increment detection.
-   * MSSQL uses IDENTITY columns, not serial/nextval sequences.
-   */
-  protected columnAttribute(columnsInfo: any, columnName: string, indexes: any) {
-    const attr = super.columnAttribute(columnsInfo, columnName, indexes);
-
-    // MSSQL IDENTITY columns are already detected by Sequelize as autoIncrement
-    // No need for nextval/uuid_generate_v4 checks (those are PostgreSQL-specific)
-
-    return attr;
-  }
-
-  /**
-   * Override getViewList — MSSQL view listing support
-   */
+  /** List only views in the configured schema; the generic MSSQL query interface has no listViews. */
   async getViewList(): Promise<string[]> {
-    try {
-      const views = await this.db.queryInterface.listViews();
-      return views.map((view: any) => (typeof view === 'string' ? view : view.name || String(view)));
-    } catch {
-      // View listing may not be supported
-      return [];
-    }
+    const rows = await this.db.sequelize.query<{ name: string }>(
+      'SELECT v.name AS name FROM sys.views v INNER JOIN sys.schemas s ON s.schema_id = v.schema_id WHERE s.name = :schema',
+      { replacements: { schema: this.db.options.schema || 'dbo' }, type: QueryTypes.SELECT },
+    );
+    return rows.map((row) => row.name);
   }
 }

package/src/server/data-source/MssqlRepository.ts

@@ -22,11 +22,13 @@ export class MssqlRepository<
   constructor(collection: Collection) {
     super(collection);
 
-    // Initialize MSSQL-specific cursor builder
+    // Initialize MSSQL-specific cursor builder (pass schema so OBJECT_ID() can resolve non-default schemas)
+    const modelOptions = this.model.options as { schema?: string };
     this.mssqlCursorBuilder = new MssqlSmartCursorBuilder(
-      (this as any).database.sequelize,
-      (this as any).model.tableName,
+      this.database.sequelize,
+      this.model.tableName,
       collection,
+      modelOptions?.schema,
     );
   }
 
@@ -51,7 +53,7 @@ export class MssqlRepository<
   ) {
     return await this.mssqlCursorBuilder.chunk({
       ...options,
-      find: (this as any).find.bind(this),
+      find: this.find.bind(this),
     });
   }
 }

package/src/server/data-source/MssqlSmartCursorBuilder.ts

@@ -10,6 +10,7 @@
 import { Sequelize, QueryTypes, Op } from 'sequelize';
 import { Model } from '@nocobase/database';
 import _ from 'lodash';
+import { quoteIdentifier } from '../security/sql-quote';
 
 interface IndexInfo {
   name: string;
@@ -125,11 +126,28 @@ export class MssqlSmartCursorBuilder {
   private sequelize: Sequelize;
   private tableName: string;
   private collection: { filterTargetKey: string | string[] };
-
-  constructor(sequelize: Sequelize, tableName: string, collection: { filterTargetKey: string | string[] }) {
+  private schema?: string;
+
+  constructor(
+    sequelize: Sequelize,
+    tableName: string,
+    collection: { filterTargetKey: string | string[] },
+    schema?: string,
+  ) {
     this.sequelize = sequelize;
     this.tableName = tableName;
     this.collection = collection;
+    this.schema = schema;
+  }
+
+  /**
+   * Fully schema-qualified, bracket-quoted object name for OBJECT_ID(). NocoBase stores the schema
+   * separately from tableName, so passing a bare tableName makes OBJECT_ID() resolve only the
+   * connection's default schema and silently miss every table living in any other schema.
+   */
+  private getQualifiedTableName(): string {
+    const quotedTable = quoteIdentifier(this.tableName);
+    return this.schema ? `${quoteIdentifier(this.schema)}.${quotedTable}` : quotedTable;
   }
 
   /**
@@ -164,7 +182,7 @@ export class MssqlSmartCursorBuilder {
     try {
       const indexRows = (await this.sequelize.query(indexInfoSql, {
         type: QueryTypes.SELECT,
-        replacements: [this.tableName],
+        replacements: [this.getQualifiedTableName()],
         raw: true,
       })) as any[];
 
@@ -260,7 +278,8 @@ export class MssqlSmartCursorBuilder {
       // Fallback to filterTargetKey
       return this.getFallbackStrategy();
     } catch (error) {
-      console.error('[MssqlSmartCursorBuilder] Error getting index info:', error);
+      const message = error instanceof Error ? error.message : String(error);
+      process.stderr.write(`[MssqlSmartCursorBuilder] Error getting index info: ${message}\n`);
       return this.getFallbackStrategy();
     }
   }
@@ -295,9 +314,14 @@ export class MssqlSmartCursorBuilder {
     options.order = cursorStrategy.buildSort();
     options['parseSort'] = false;
 
+    // Snapshot the caller's WHERE once. The composite-key strategy wraps baseWhere in Op.and, so
+    // reusing options.where (already mutated by the previous batch) would nest one Op.and deeper on
+    // every batch and grow the generated SQL linearly. Rebuilding from baseWhere keeps it constant.
+    const baseWhere = options.where;
+
     while (hasMoreData) {
       if (!isFirst) {
-        options.where = cursorStrategy.buildWhere(options.where, cursorRecord);
+        options.where = cursorStrategy.buildWhere(baseWhere, cursorRecord);
       }
       if (isFirst) {
         isFirst = false;

package/src/server/data-source/mssql-bulk-introspection.ts

@@ -0,0 +1,128 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { quoteUnicodeStringLiteral } from '../security/sql-quote';
+
+/**
+ * Shape of one row returned by the bulk column introspection query.
+ * Mirrors what Sequelize's `describeTable()` produces per column so that
+ * `getTableColumnsInfo()` can build a compatible `{ [columnName]: {...} }` map
+ * entirely from memory, instead of one `sp_columns`-style round trip per table.
+ */
+export interface MssqlBulkColumnRow {
+  table_name: string;
+  column_name: string;
+  data_type: string;
+  max_length: number;
+  is_nullable: boolean;
+  is_identity: boolean;
+  default_value: string | null;
+  column_comment: string | null;
+}
+
+/**
+ * A single column's metadata, keyed under its table in the per-table cache.
+ * This is the exact per-column shape Sequelize's MSSQL `describeTable()` returns.
+ */
+export interface MssqlDescribeColumn {
+  type: string;
+  allowNull: boolean;
+  defaultValue: string | undefined;
+  primaryKey: boolean;
+  autoIncrement: boolean;
+  comment: string | null;
+}
+
+export type MssqlTableColumns = Record<string, MssqlDescribeColumn>;
+
+/**
+ * Build the bulk column introspection SQL for an entire schema.
+ *
+ * Adapted from dbgate-plugin-mssql's `sql/columns.js`, but bulk (schema-wide, not
+ * per-object) so the whole catalog loads in one round trip. The schema name is
+ * passed as a Unicode string literal — never interpolated raw — to avoid any
+ * SQL-injection surface.
+ *
+ * Reads from the `sys.*` catalog (plus `sys.default_constraints` / `sys.computed_columns`)
+ * rather than `INFORMATION_SCHEMA` so that identity/computed/default metadata is available.
+ */
+export function buildBulkColumnsSql(schemaName: string): string {
+  const schema = quoteUnicodeStringLiteral(schemaName);
+  return `
+SELECT
+  o.name AS table_name,
+  c.name AS column_name,
+  t.name AS data_type,
+  c.max_length AS max_length,
+  c.is_nullable AS is_nullable,
+  c.is_identity AS is_identity,
+  d.definition AS default_value,
+  CAST(ep.value AS NVARCHAR(MAX)) AS column_comment
+FROM sys.columns c
+INNER JOIN sys.types t
+  ON c.system_type_id = t.system_type_id AND c.user_type_id = t.user_type_id
+INNER JOIN sys.tables o
+  ON c.object_id = o.object_id
+INNER JOIN sys.schemas u
+  ON u.schema_id = o.schema_id
+LEFT JOIN sys.default_constraints d
+  ON c.default_object_id = d.object_id
+LEFT JOIN sys.extended_properties ep
+  ON ep.major_id = c.object_id AND ep.minor_id = c.column_id AND ep.class = 1 AND ep.name = 'MS_Description'
+WHERE u.name = ${schema}
+  AND o.is_ms_shipped = 0
+ORDER BY o.name, c.column_id
+`;
+}
+
+/**
+ * Format a character/binary data type with its length, matching the Sequelize
+ * `describeTable()` convention: `nvarchar(255)`, `varchar(MAX)`, etc.
+ * `n*` types store length as bytes, so the char count is `max_length / 2`.
+ */
+export function formatColumnType(dataType: string, maxLength: number): string {
+  const type = dataType.toUpperCase();
+  const isCharOrBinary = /CHAR|BINARY/.test(type);
+  if (!isCharOrBinary) {
+    return type;
+  }
+  if (maxLength === -1) {
+    return `${type}(MAX)`;
+  }
+  // nvarchar/nchar report max_length in bytes (2 bytes per char)
+  const charLength = type.startsWith('N') && !type.includes('BINARY') ? maxLength / 2 : maxLength;
+  return `${type}(${charLength})`;
+}
+
+/**
+ * Group flat bulk-query rows into the per-table `describeTable`-compatible map:
+ * `{ [tableName]: { [columnName]: MssqlDescribeColumn } }`.
+ */
+export function groupColumnsByTable(rows: MssqlBulkColumnRow[]): Map<string, MssqlTableColumns> {
+  const byTable = new Map<string, MssqlTableColumns>();
+
+  for (const row of rows) {
+    let table = byTable.get(row.table_name);
+    if (!table) {
+      table = {};
+      byTable.set(row.table_name, table);
+    }
+
+    table[row.column_name] = {
+      type: formatColumnType(row.data_type, row.max_length),
+      allowNull: !!row.is_nullable,
+      defaultValue: row.default_value ?? undefined,
+      primaryKey: false, // resolved separately via the PK cache
+      autoIncrement: !!row.is_identity,
+      comment: row.column_comment ?? null,
+    };
+  }
+
+  return byTable;
+}