sqlite-hub 0.10.0 → 0.12.0

package/server/services/sqlite/introspection.js

@@ -64,6 +64,198 @@ function normalizeColumn(column, visibleSet) {
   };
 }
 
+function isIdentifierCharacter(character) {
+  return /[A-Za-z0-9_$]/.test(character);
+}
+
+function skipQuotedSql(text, index) {
+  const quote = text[index];
+  let cursor = index + 1;
+
+  while (cursor < text.length) {
+    if (text[cursor] === quote) {
+      if (text[cursor + 1] === quote) {
+        cursor += 2;
+        continue;
+      }
+
+      return cursor + 1;
+    }
+
+    cursor += 1;
+  }
+
+  return text.length;
+}
+
+function findMatchingParenthesis(text, openIndex) {
+  let depth = 0;
+
+  for (let index = openIndex; index < text.length; index += 1) {
+    const character = text[index];
+
+    if (character === "'" || character === '"' || character === "`") {
+      index = skipQuotedSql(text, index) - 1;
+      continue;
+    }
+
+    if (character === "[") {
+      const closeIndex = text.indexOf("]", index + 1);
+      index = closeIndex === -1 ? text.length : closeIndex;
+      continue;
+    }
+
+    if (character === "(") {
+      depth += 1;
+      continue;
+    }
+
+    if (character === ")") {
+      depth -= 1;
+
+      if (depth === 0) {
+        return index;
+      }
+    }
+  }
+
+  return -1;
+}
+
+function extractCheckExpressions(ddl = "") {
+  const expressions = [];
+  const checkPattern = /\bCHECK\s*\(/gi;
+  let match;
+
+  while ((match = checkPattern.exec(ddl))) {
+    const openIndex = ddl.indexOf("(", match.index);
+    const closeIndex = findMatchingParenthesis(ddl, openIndex);
+
+    if (closeIndex === -1) {
+      continue;
+    }
+
+    expressions.push(ddl.slice(openIndex + 1, closeIndex));
+    checkPattern.lastIndex = closeIndex + 1;
+  }
+
+  return expressions;
+}
+
+function normalizeIdentifier(value) {
+  const text = String(value ?? "").trim();
+
+  if (text.startsWith('"') && text.endsWith('"')) {
+    return text.slice(1, -1).replace(/""/g, '"').toLowerCase();
+  }
+
+  if (text.startsWith("`") && text.endsWith("`")) {
+    return text.slice(1, -1).replace(/``/g, "`").toLowerCase();
+  }
+
+  if (text.startsWith("[") && text.endsWith("]")) {
+    return text.slice(1, -1).replace(/\]\]/g, "]").toLowerCase();
+  }
+
+  return text.toLowerCase();
+}
+
+function parseSqlStringList(text = "") {
+  const values = [];
+  let index = 0;
+
+  while (index < text.length) {
+    if (text[index] !== "'") {
+      index += 1;
+      continue;
+    }
+
+    let value = "";
+    index += 1;
+
+    while (index < text.length) {
+      if (text[index] === "'") {
+        if (text[index + 1] === "'") {
+          value += "'";
+          index += 2;
+          continue;
+        }
+
+        index += 1;
+        values.push(value);
+        break;
+      }
+
+      value += text[index];
+      index += 1;
+    }
+  }
+
+  return values;
+}
+
+function findColumnInListExpression(expression, columnName) {
+  const normalizedColumnName = normalizeIdentifier(columnName);
+  const identifierPattern = /(?:"(?:[^"]|"")+"|`(?:[^`]|``)+`|\[[^\]]+\]|[A-Za-z_][A-Za-z0-9_$]*)\s+IN\s*\(/gi;
+  let match;
+
+  while ((match = identifierPattern.exec(expression))) {
+    const matchedIdentifier = match[0].replace(/\s+IN\s*\($/i, "").trim();
+
+    if (normalizeIdentifier(matchedIdentifier) !== normalizedColumnName) {
+      continue;
+    }
+
+    const before = expression[match.index - 1] ?? "";
+
+    if (before && isIdentifierCharacter(before)) {
+      continue;
+    }
+
+    const openIndex = expression.indexOf("(", match.index + matchedIdentifier.length);
+    const closeIndex = findMatchingParenthesis(expression, openIndex);
+
+    if (closeIndex === -1) {
+      continue;
+    }
+
+    const values = parseSqlStringList(expression.slice(openIndex + 1, closeIndex));
+
+    if (values.length) {
+      return values;
+    }
+  }
+
+  return [];
+}
+
+function parseCheckAllowedValues(ddl = "", columns = []) {
+  const allowedValuesByColumn = new Map();
+  const expressions = extractCheckExpressions(ddl);
+
+  columns.forEach((column) => {
+    const values = [];
+    const seen = new Set();
+
+    expressions.forEach((expression) => {
+      findColumnInListExpression(expression, column.name).forEach((value) => {
+        if (seen.has(value)) {
+          return;
+        }
+
+        seen.add(value);
+        values.push(value);
+      });
+    });
+
+    if (values.length) {
+      allowedValuesByColumn.set(column.name, values);
+    }
+  });
+
+  return allowedValuesByColumn;
+}
+
 function groupForeignKeys(rows) {
   const grouped = new Map();
 
@@ -140,9 +332,15 @@ function getTableDetail(db, tableName, options = {}) {
     .all();
   const visibleSet = new Set(tableInfo.map((column) => column.name));
 
-  const columns = extendedInfo
+  let columns = extendedInfo
     .map((column) => normalizeColumn(column, visibleSet))
     .sort((left, right) => left.cid - right.cid);
+  const allowedValuesByColumn = parseCheckAllowedValues(entry.sql, columns);
+
+  columns = columns.map((column) => ({
+    ...column,
+    allowedValues: allowedValuesByColumn.get(column.name) ?? [],
+  }));
 
   const foreignKeys = groupForeignKeys(
     db.prepare(`PRAGMA foreign_key_list(${quoteIdentifier(tableName)})`).all()

package/server/services/sqlite/sqlExecutor.js

@@ -223,6 +223,8 @@ function mapEditableColumns(tableDetail, columnDefinitions) {
       visible: isRowId ? true : Boolean(columnMeta?.visible),
       generated: Boolean(columnMeta?.generated),
       identity: identityColumns.has(definition.column),
+      notNull: Boolean(columnMeta?.notNull),
+      allowedValues: columnMeta?.allowedValues ?? [],
     };
   });
 }

package/server/services/sqlite/tableFilter.js

@@ -0,0 +1,75 @@
+const { ValidationError } = require("../../utils/errors");
+const { quoteIdentifier } = require("../../utils/identifier");
+
+const FILTER_OPERATORS = new Set(["=", "!=", "<", ">", "<=", ">=", "equals"]);
+
+function escapeLikePattern(value) {
+  return String(value).replace(/[\\%_]/g, (character) => `\\${character}`);
+}
+
+function isTextColumn(column) {
+  return String(column?.affinity ?? "").toUpperCase() === "TEXT";
+}
+
+function normalizeTableFilter(tableDetail, options = {}) {
+  const columnName = String(options.filterColumn ?? "").trim();
+  const operator = String(options.filterOperator ?? "=").trim();
+  const value = options.filterValue;
+
+  if (!columnName || value === undefined || value === null || String(value).trim() === "") {
+    return null;
+  }
+
+  if (!FILTER_OPERATORS.has(operator)) {
+    throw new ValidationError(
+      `filterOperator must be one of: ${Array.from(FILTER_OPERATORS).join(", ")}.`
+    );
+  }
+
+  const filterColumn = tableDetail.columns.find(
+    (column) => column.visible && column.name === columnName
+  );
+
+  if (!filterColumn) {
+    throw new ValidationError(`Unknown filter column: ${columnName}.`);
+  }
+
+  const normalizedValue = String(value);
+  const quotedColumn = quoteIdentifier(filterColumn.name);
+
+  if (operator === "equals") {
+    return {
+      column: filterColumn.name,
+      operator,
+      value: normalizedValue,
+      matchMode: "equals",
+      clause: `${quotedColumn}${isTextColumn(filterColumn) ? " COLLATE NOCASE" : ""} = ?`,
+      params: [normalizedValue],
+    };
+  }
+
+  if (isTextColumn(filterColumn) && (operator === "=" || operator === "!=")) {
+    return {
+      column: filterColumn.name,
+      operator,
+      value: normalizedValue,
+      matchMode: operator === "=" ? "contains" : "notContains",
+      clause: `${quotedColumn} COLLATE NOCASE ${operator === "=" ? "LIKE" : "NOT LIKE"} ? ESCAPE '\\'`,
+      params: [`%${escapeLikePattern(normalizedValue)}%`],
+    };
+  }
+
+  return {
+    column: filterColumn.name,
+    operator,
+    value: normalizedValue,
+    matchMode: "comparison",
+    clause: `${quotedColumn} ${operator} ?`,
+    params: [normalizedValue],
+  };
+}
+
+module.exports = {
+  FILTER_OPERATORS,
+  normalizeTableFilter,
+};

package/server/utils/csv.js

@@ -1,10 +1,13 @@
-function escapeCsvCell(value, delimiter) {
+function stringifyDelimitedCell(value) {
   if (value === null || value === undefined) {
     return "";
   }
 
-  const stringValue =
-    typeof value === "object" ? JSON.stringify(value) : String(value);
+  return typeof value === "object" ? JSON.stringify(value) : String(value);
+}
+
+function escapeCsvCell(value, delimiter) {
+  const stringValue = stringifyDelimitedCell(value);
 
   if (
     stringValue.includes('"') ||
@@ -18,7 +21,7 @@ function escapeCsvCell(value, delimiter) {
   return stringValue;
 }
 
-function rowsToCsv({ columns, rows, delimiter = "," }) {
+function rowsToDelimitedText({ columns, rows, delimiter = "," }) {
   const header = columns.map((column) => escapeCsvCell(column, delimiter)).join(delimiter);
   const body = rows.map((row) =>
     columns
@@ -29,6 +32,29 @@ function rowsToCsv({ columns, rows, delimiter = "," }) {
   return [header, ...body].join("\n");
 }
 
+function rowsToCsv({ columns, rows, delimiter = "," }) {
+  return rowsToDelimitedText({ columns, rows, delimiter });
+}
+
+function escapeMarkdownCell(value) {
+  return stringifyDelimitedCell(value)
+    .replaceAll("\\", "\\\\")
+    .replaceAll("|", "\\|")
+    .replace(/\r\n|\r|\n/g, "<br>");
+}
+
+function rowsToMarkdownTable({ columns, rows }) {
+  const header = `| ${columns.map(escapeMarkdownCell).join(" | ")} |`;
+  const separator = `| ${columns.map(() => "---").join(" | ")} |`;
+  const body = rows.map(
+    (row) => `| ${columns.map((column) => escapeMarkdownCell(row[column])).join(" | ")} |`
+  );
+
+  return [header, separator, ...body].join("\n");
+}
+
 module.exports = {
   rowsToCsv,
+  rowsToDelimitedText,
+  rowsToMarkdownTable,
 };

package/tests/check-constraint-options.test.js

@@ -0,0 +1,76 @@
+const Database = require("better-sqlite3");
+const assert = require("node:assert/strict");
+const test = require("node:test");
+const { getTableDetail } = require("../server/services/sqlite/introspection");
+const { SqlExecutor } = require("../server/services/sqlite/sqlExecutor");
+
+test("table detail exposes string options from simple CHECK IN constraints", () => {
+  const db = new Database(":memory:");
+
+  try {
+    db.exec(`
+      CREATE TABLE stream_company_mentions (
+        id INTEGER PRIMARY KEY,
+        mention_type TEXT,
+        CHECK (
+          mention_type IS NULL
+          OR mention_type IN (
+            'company',
+            'stock_company',
+            'brand',
+            'product',
+            'person',
+            'organization',
+            'terrorists',
+            'events',
+            'collective_terms',
+            'countries',
+            'none',
+            'unknown'
+          )
+        )
+      );
+      INSERT INTO stream_company_mentions (mention_type) VALUES ('company');
+    `);
+
+    const tableDetail = getTableDetail(db, "stream_company_mentions");
+    const mentionTypeColumn = tableDetail.columns.find(
+      (column) => column.name === "mention_type"
+    );
+
+    assert.deepEqual(mentionTypeColumn.allowedValues, [
+      "company",
+      "stock_company",
+      "brand",
+      "product",
+      "person",
+      "organization",
+      "terrorists",
+      "events",
+      "collective_terms",
+      "countries",
+      "none",
+      "unknown",
+    ]);
+
+    const executor = new SqlExecutor({
+      connectionManager: {
+        getActiveDatabase: () => db,
+        getActiveConnection: () => ({ id: "test" }),
+      },
+      appStateStore: {
+        recordQueryExecution: () => 1,
+      },
+    });
+    const result = executor.execute(
+      "SELECT id, mention_type FROM stream_company_mentions"
+    );
+    const editableColumn = result.editing.columns.find(
+      (column) => column.sourceColumn === "mention_type"
+    );
+
+    assert.deepEqual(editableColumn.allowedValues, mentionTypeColumn.allowedValues);
+  } finally {
+    db.close();
+  }
+});

package/tests/sql-identifier-safety.test.js

@@ -39,6 +39,65 @@ test("data browser mutations preserve quoted dynamic identifiers", () => {
       },
     });
     const tableData = service.getTableData(tableName, { limit: 10, offset: 0 });
+    const filteredTableData = service.getTableData(tableName, {
+      limit: 10,
+      offset: 0,
+      filterColumn: valueColumn,
+      filterOperator: "=",
+      filterValue: "EFO",
+    });
+    const negativeFilteredTableData = service.getTableData(tableName, {
+      limit: 10,
+      offset: 0,
+      filterColumn: valueColumn,
+      filterOperator: "!=",
+      filterValue: "EFO",
+    });
+    const exactFilteredTableData = service.getTableData(tableName, {
+      limit: 10,
+      offset: 0,
+      filterColumn: valueColumn,
+      filterOperator: "equals",
+      filterValue: "BEFORE",
+    });
+    const exactSubstringMissTableData = service.getTableData(tableName, {
+      limit: 10,
+      offset: 0,
+      filterColumn: valueColumn,
+      filterOperator: "equals",
+      filterValue: "EFO",
+    });
+
+    assert.equal(filteredTableData.rowCount, 1);
+    assert.equal(filteredTableData.rows[0][valueColumn], "before");
+    assert.deepEqual(filteredTableData.filter, {
+      column: valueColumn,
+      operator: "=",
+      value: "EFO",
+      matchMode: "contains",
+    });
+    assert.equal(negativeFilteredTableData.rowCount, 0);
+    assert.equal(exactFilteredTableData.rowCount, 1);
+    assert.equal(exactFilteredTableData.rows[0][valueColumn], "before");
+    assert.deepEqual(exactFilteredTableData.filter, {
+      column: valueColumn,
+      operator: "equals",
+      value: "BEFORE",
+      matchMode: "equals",
+    });
+    assert.equal(exactSubstringMissTableData.rowCount, 0);
+    assert.throws(
+      () =>
+        service.getTableData(tableName, {
+          limit: 10,
+          offset: 0,
+          filterColumn: valueColumn,
+          filterOperator: "<>",
+          filterValue: "before",
+        }),
+      /filterOperator/
+    );
+
     const identity = tableData.rows[0].__identity;
     const preview = service.previewTableRowUpdate(tableName, {
       identity,