ts-prorm-orm 1.2.1 → 1.2.2

package/CHANGELOG.md

@@ -5,6 +5,35 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.2.2]
+
+### Fixed
+
+- **`HAVING` silently dropped every operator.** The having builders compared
+  operator keys against stringified symbol names (`'Symbol(gt)'`), which
+  `Object.keys()` cannot produce and which the `$gt` string form never matched
+  either — so `having: { n: { [Op.gt]: 1 } }` became `HAVING n = 1` and returned
+  wrong rows without erroring. HAVING now reuses the WHERE builder, which
+  already handled both forms, across sqlite, mysql, mariadb, postgres and
+  cockroachdb.
+- **`where: { '$assoc.column$': v }` was silently ignored.** Every where-builder
+  skips keys starting with `$` as unrecognized logical operators, so the
+  condition was dropped and the query returned every parent. These now filter
+  the parent rows via the association's include; naming an alias that isn't
+  included raises `AssociationError` instead of being discarded.
+- **Aggregates ignored paranoid filtering and scopes**, so `sum`/`min`/`max`
+  could include soft-deleted rows that `findAll` excluded. They also rebuilt
+  their WHERE by regex-matching `/WHERE (.+)$/` out of a rendered SELECT, which
+  breaks on any condition containing that word. All four now share one
+  implementation honouring `where`, paranoid, scopes and filtering includes, and
+  report unknown attribute names.
+
+### Added
+
+- **`avg()`** — the one standard aggregate that was missing.
+- `exports` now permits `ts-prorm-orm/package.json`, which build tooling and
+  version checks commonly read.
+
 ## [1.2.1]
 
 ### Fixed

package/README.md

@@ -29,6 +29,9 @@ A TypeScript ORM supporting multiple database dialects with full TypeScript supp
 - **Validation**: Built-in and custom validators
 - **Stored Procedures**: Create and call stored procedures (across supported dialects)
 - **Triggers**: Database triggers with FOR EACH ROW and WHEN clauses (across supported dialects)
+- **Aggregates**: `count`, `sum`, `avg`, `min`, `max` — all issuing real SQL
+  aggregates and honouring `where`, scopes, soft-deletes and relation filters;
+  `group` + `having` for grouped results
 - **Sequences**: `createSequence()` on PostgreSQL, MariaDB, Oracle, MSSQL, Db2 and
   friends. SQLite and MySQL have no sequences and report that explicitly rather
   than emitting SQL the driver rejects

package/dist/dialects/cockroachdb/index.js

@@ -3797,12 +3797,18 @@ class CockroachDBDialect {
      */
     buildHavingClause(having) {
         const values = [];
-        if (!having || (typeof having === 'object' && Object.keys(having).length === 0)) {
+        if (!having ||
+            (typeof having === 'object' &&
+                Object.keys(having).length === 0 &&
+                Object.getOwnPropertySymbols(having).length === 0)) {
             return { sql: '', values };
         }
-        // Use the condition builder with Op operator support
-        const sql = this.buildCondition(having, values);
-        return { sql, values };
+        // HAVING shares WHERE's expression grammar, so reuse that builder rather
+        // than a second dispatch. `buildCondition` compared operator keys against
+        // stringified symbol names ('Symbol(gt)'), which Object.keys() can never
+        // produce and which the `$gt` string form never matches either - so every
+        // operator silently degraded to equality and HAVING returned wrong rows.
+        return this.buildWhereClause(having);
     }
     /**
      * Build the expression used after `AS OF SYSTEM TIME` for CockroachDB

package/dist/dialects/mariadb/index.js

@@ -2872,12 +2872,18 @@ class MariaDBDialect {
      */
     buildHavingClause(having) {
         const values = [];
-        if (!having || (typeof having === 'object' && Object.keys(having).length === 0)) {
+        if (!having ||
+            (typeof having === 'object' &&
+                Object.keys(having).length === 0 &&
+                Object.getOwnPropertySymbols(having).length === 0)) {
             return { sql: '', values };
         }
-        // Use the condition builder with Op operator support
-        const sql = this.buildCondition(having, values);
-        return { sql, values };
+        // HAVING shares WHERE's expression grammar, so reuse that builder rather
+        // than a second dispatch. `buildCondition` compared operator keys against
+        // stringified symbol names ('Symbol(gt)'), which Object.keys() can never
+        // produce and which the `$gt` string form never matches either - so every
+        // operator silently degraded to equality and HAVING returned wrong rows.
+        return this.buildWhereClause(having);
     }
     /**
      * Build a SELECT query with support for Common Table Expressions (CTEs)

package/dist/dialects/mysql/index.js

@@ -3368,12 +3368,18 @@ class MySQLDialect {
      */
     buildHavingClause(having) {
         const values = [];
-        if (!having || (typeof having === 'object' && Object.keys(having).length === 0)) {
+        if (!having ||
+            (typeof having === 'object' &&
+                Object.keys(having).length === 0 &&
+                Object.getOwnPropertySymbols(having).length === 0)) {
             return { sql: '', values };
         }
-        // Use the condition builder with Op operator support
-        const sql = this.buildCondition(having, values);
-        return { sql, values };
+        // HAVING shares WHERE's expression grammar, so reuse that builder rather
+        // than a second dispatch. `buildCondition` compared operator keys against
+        // stringified symbol names ('Symbol(gt)'), which Object.keys() can never
+        // produce and which the `$gt` string form never matches either - so every
+        // operator silently degraded to equality and HAVING returned wrong rows.
+        return this.buildWhereClause(having);
     }
     /**
      * Build a `WITH [RECURSIVE] name (cols) AS (query), ...` prefix for the

package/dist/dialects/postgres/index.js

@@ -4138,12 +4138,18 @@ class PostgresDialect {
      */
     buildHavingClause(having) {
         const values = [];
-        if (!having || (typeof having === 'object' && Object.keys(having).length === 0)) {
+        if (!having ||
+            (typeof having === 'object' &&
+                Object.keys(having).length === 0 &&
+                Object.getOwnPropertySymbols(having).length === 0)) {
             return { sql: '', values };
         }
-        // Use the condition builder with Op operator support
-        const sql = this.buildCondition(having, values);
-        return { sql, values };
+        // HAVING shares WHERE's expression grammar, so reuse that builder rather
+        // than a second dispatch. `buildCondition` compared operator keys against
+        // stringified symbol names ('Symbol(gt)'), which Object.keys() can never
+        // produce and which the `$gt` string form never matches either - so every
+        // operator silently degraded to equality and HAVING returned wrong rows.
+        return this.buildWhereClause(having);
     }
     /**
      * Build a SELECT query with PostgreSQL-specific features

package/dist/dialects/sqlite/index.js

@@ -2940,12 +2940,18 @@ class SQLiteDialect {
      */
     buildHavingClause(having) {
         const values = [];
-        if (!having || (typeof having === 'object' && Object.keys(having).length === 0)) {
+        if (!having ||
+            (typeof having === 'object' &&
+                Object.keys(having).length === 0 &&
+                Object.getOwnPropertySymbols(having).length === 0)) {
             return { sql: '', values };
         }
-        // Use the condition builder with Op operator support
-        const sql = this.buildCondition(having, values);
-        return { sql, values };
+        // HAVING shares WHERE's expression grammar, so reuse that builder rather
+        // than a second dispatch. `buildCondition` compared operator keys against
+        // stringified symbol names ('Symbol(gt)'), which Object.keys() can never
+        // produce and which the `$gt` string form never matches either - so every
+        // operator silently degraded to equality and HAVING returned wrong rows.
+        return this.buildWhereClause(having);
     }
     /**
      * Build a `WITH [RECURSIVE] name [(cols)] AS (query), ...` clause from

package/dist/models/model.d.ts

@@ -763,9 +763,9 @@ declare const _default: {
             path: string;
             value?: any;
         }) => Record<string, any>;
-        readonly literal: (value: string) => import("..").LiteralValue;
+        readonly literal: (value: string) => import("../operators").LiteralValue;
         readonly cast: (value: any, type: string) => import("./operators").CastExpression;
-        readonly extract: (field: any, part: import("..").ExtractPart) => import("./operators").ExtractExpression;
+        readonly extract: (field: any, part: import("../operators").ExtractPart) => import("./operators").ExtractExpression;
         readonly conv: (value: any, from: string | null | undefined, to: string) => import("./operators").ConvExpression;
         readonly where: (column: {
             $col: string;

package/dist/models/model.js

@@ -41,6 +41,7 @@ exports.ModelValidator = exports.ModelInstance = exports.Model = void 0;
 exports.createModel = createModel;
 const eager_load_1 = require("./eager-load");
 const operators_1 = require("./operators");
+const operators_2 = require("../operators");
 const scopes_1 = require("./scopes");
 const associations_1 = require("./associations");
 const validators_1 = require("../validators");
@@ -2869,7 +2870,7 @@ function createModel(prorm, modelName, attributes, options = {}) {
                 limit: findOptions.limit,
                 offset: findOptions.offset,
                 group: findOptions.group,
-                having: findOptions.having,
+                having: (0, operators_2.normalizeOperatorKeys)(findOptions.having),
                 raw: findOptions.raw,
                 subQuery: subquery,
                 duplicate: hasDuplicateColumns,
@@ -2947,7 +2948,7 @@ function createModel(prorm, modelName, attributes, options = {}) {
                 limit: findOptions.limit,
                 offset: findOptions.offset,
                 group: findOptions.group,
-                having: findOptions.having,
+                having: (0, operators_2.normalizeOperatorKeys)(findOptions.having),
                 subQuery: findOptions.subQuery,
                 raw: findOptions.raw,
                 distinct: findOptions.distinct,
@@ -3048,7 +3049,7 @@ function createModel(prorm, modelName, attributes, options = {}) {
                 where: findOptions.where,
                 include: findOptions.include,
                 group: findOptions.group,
-                having: findOptions.having,
+                having: (0, operators_2.normalizeOperatorKeys)(findOptions.having),
                 raw: findOptions.raw,
                 distinct: findOptions.distinct,
                 col: findOptions.col,

package/dist/operators.d.ts

@@ -1716,6 +1716,17 @@ export interface WhereConditionOptions {
 /**
  * Convert operator symbol to where clause key
  */
+/**
+ * Recursively rewrite `Op.*` symbol keys into their `$string` equivalents.
+ *
+ * `Op.gt` and friends are Symbols, and most builders walk conditions with
+ * `Object.entries()`, which skips symbol keys entirely. The WHERE path
+ * normalizes them per-dialect; HAVING did not, so
+ * `having: { n: { [Op.gt]: 1 } }` lost the operator and silently degraded to
+ * equality - returning wrong rows rather than an error. Normalizing centrally
+ * means every consumer sees the string form.
+ */
+export declare function normalizeOperatorKeys<T>(value: T): T;
 export declare function operatorToWhereKey(op: OperatorSymbol): string;
 /**
  * Type for where condition object (plain object with field conditions)

package/dist/operators.js

@@ -5,6 +5,7 @@ exports.isColumnReference = isColumnReference;
 exports.isColOperator = isColOperator;
 exports.isOperator = isOperator;
 exports.getOperatorString = getOperatorString;
+exports.normalizeOperatorKeys = normalizeOperatorKeys;
 exports.operatorToWhereKey = operatorToWhereKey;
 exports.where = where;
 exports.and = and;
@@ -1134,6 +1135,40 @@ function getOperatorString(op) {
 /**
  * Convert operator symbol to where clause key
  */
+/**
+ * Recursively rewrite `Op.*` symbol keys into their `$string` equivalents.
+ *
+ * `Op.gt` and friends are Symbols, and most builders walk conditions with
+ * `Object.entries()`, which skips symbol keys entirely. The WHERE path
+ * normalizes them per-dialect; HAVING did not, so
+ * `having: { n: { [Op.gt]: 1 } }` lost the operator and silently degraded to
+ * equality - returning wrong rows rather than an error. Normalizing centrally
+ * means every consumer sees the string form.
+ */
+function normalizeOperatorKeys(value) {
+    if (Array.isArray(value)) {
+        return value.map((v) => normalizeOperatorKeys(v));
+    }
+    if (value === null || typeof value !== 'object')
+        return value;
+    // Leave class instances (Date, Buffer, literal/fn expressions) alone.
+    if (value instanceof Date ||
+        Buffer.isBuffer(value) ||
+        value.__type !== undefined) {
+        return value;
+    }
+    const src = value;
+    const out = {};
+    for (const [k, v] of Object.entries(src)) {
+        out[k] = normalizeOperatorKeys(v);
+    }
+    for (const sym of Object.getOwnPropertySymbols(src)) {
+        const strKey = operatorToWhereKey(sym);
+        if (strKey)
+            out[strKey] = normalizeOperatorKeys(src[sym]);
+    }
+    return out;
+}
 function operatorToWhereKey(op) {
     if (op === exports.Op.and)
         return '$and';

package/dist/prorm.d.ts

@@ -1672,6 +1672,17 @@ export declare class Prorm extends EventEmitter {
      *  - `group` returns the number of groups
      */
     private _countRows;
+    /**
+     * Run a single-value aggregate (MAX/MIN/SUM/AVG) for a model.
+     *
+     * `max`/`min`/`sum` each carried their own copy of this, built the WHERE by
+     * rendering a throwaway SELECT and pulling the clause back out with
+     * `/WHERE (.+)$/` — which breaks on any condition containing the word WHERE
+     * (a subquery, or a string value) — and none of them honored paranoid
+     * filtering, scopes, or filtering includes, so an aggregate could silently
+     * include soft-deleted rows that `findAll` excluded.
+     */
+    private _aggregate;
     /**
      * The view of this instance that the shared eager-loader needs.
      */

package/dist/prorm.js

@@ -461,6 +461,38 @@ function resolveModelPrimaryKeyAttr(m) {
     }
     return 'id';
 }
+/**
+ * Split `$alias.column$` keys out of a where clause.
+ *
+ * This syntax names a column on an included association. Every where-builder
+ * skips keys beginning with `$` as unrecognized logical operators, so these
+ * conditions were dropped without a word and the query came back unfiltered.
+ * Pulling them out here lets each be applied to its association's include,
+ * which does filter the parent rows.
+ */
+function extractAssociationConditions(where) {
+    const conditions = [];
+    if (!where || typeof where !== 'object')
+        return { rest: where, conditions };
+    const rest = {};
+    for (const [key, value] of Object.entries(where)) {
+        const match = /^\$(.+)\$$/.exec(key);
+        if (match) {
+            const path = match[1];
+            const dot = path.lastIndexOf('.');
+            if (dot > 0) {
+                conditions.push({
+                    alias: path.slice(0, dot),
+                    column: path.slice(dot + 1),
+                    value,
+                });
+                continue;
+            }
+        }
+        rest[key] = value;
+    }
+    return { rest, conditions };
+}
 /**
  * Derive a model's table name from its name and options.
  *
@@ -2876,6 +2908,27 @@ class Prorm extends events_1.EventEmitter {
                 // queries returned every parent regardless. Resolve the matching parent
                 // keys first and constrain the main query with them, so the restriction
                 // is applied before LIMIT/OFFSET rather than after.
+                // `where: { '$posts.title$': 'x' }` names a column on an included
+                // association. The where-builders skip any key starting with `$` as an
+                // unrecognized logical operator, so these conditions were silently
+                // dropped and the query returned every parent unfiltered. Move each one
+                // onto its association's include, where it filters parents.
+                const crossTableWhere = extractAssociationConditions(where);
+                if (crossTableWhere.conditions.length > 0) {
+                    where = crossTableWhere.rest;
+                    const includeList = (findOptions.include || []).slice();
+                    for (const { alias, column, value } of crossTableWhere.conditions) {
+                        const target = includeList.find((inc) => (inc?.as ?? inc?.model?.name) === alias);
+                        if (target) {
+                            target.where = { ...(target.where || {}), [column]: value };
+                        }
+                        else {
+                            throw new errors_1.AssociationError(`where key '$${alias}.${column}$' refers to '${alias}', which is not ` +
+                                `included in this query. Add \`include: [{ model: ..., as: '${alias}' }]\`.`, { association: alias });
+                        }
+                    }
+                    findOptions = { ...findOptions, include: includeList };
+                }
                 if (findOptions.include && findOptions.include.length > 0) {
                     for (const rawInclude of findOptions.include) {
                         const filter = await (0, eager_load_1.resolveRequiredIncludeFilter)(self.eagerLoadContext(), model, modelName, rawInclude);
@@ -2915,7 +2968,10 @@ class Prorm extends events_1.EventEmitter {
                     limit: findOptions.limit,
                     offset: findOptions.offset,
                     group: findOptions.group,
-                    having: findOptions.having,
+                    // Normalize Op.* symbol keys: the HAVING builders walk conditions
+                    // with Object.entries(), which skips symbols, so an unnormalized
+                    // `{ [Op.gt]: 1 }` silently degraded to `= 1`.
+                    having: (0, operators_1.normalizeOperatorKeys)(findOptions.having),
                     raw: findOptions.raw,
                     subQuery: findOptions.subquery,
                     benchmark: findOptions.benchmark,
@@ -3849,72 +3905,20 @@ class Prorm extends events_1.EventEmitter {
                 });
                 return association;
             },
-            // Additional methods required by ModelStatic
-            async max(attribute, aggOptions) {
-                if (!self.dialect)
-                    throw new Error('Database not connected');
-                const dialect = self.dialect;
-                const escapedAttr = dialect.escapeId(attribute);
-                const escapedTable = dialect.escapeId(this.tableName);
-                let sql = `SELECT MAX(${escapedAttr}) AS __agg FROM ${escapedTable}`;
-                if (aggOptions?.where) {
-                    const whereQuery = dialect.buildSelectQuery({
-                        tableName: this.tableName,
-                        where: aggOptions.where,
-                    });
-                    const whereMatch = dialect
-                        .replaceReplacements(whereQuery.sql, whereQuery.values)
-                        .match(/WHERE (.+)$/i);
-                    if (whereMatch)
-                        sql += ` WHERE ${whereMatch[1]}`;
-                }
-                const result = await dialect.query(sql);
-                const val = result.rows[0]?.__agg;
-                return val !== null && val !== undefined ? Number(val) : null;
+            // Single-value aggregates. All four share one implementation that
+            // honors where, paranoid filtering, scopes and filtering includes.
+            async max(attribute, aggOptions = {}) {
+                return self._aggregate(model, modelName, 'MAX', attribute, this._mergeScopes(aggOptions));
             },
-            async min(attribute, aggOptions) {
-                if (!self.dialect)
-                    throw new Error('Database not connected');
-                const dialect = self.dialect;
-                const escapedAttr = dialect.escapeId(attribute);
-                const escapedTable = dialect.escapeId(this.tableName);
-                let sql = `SELECT MIN(${escapedAttr}) AS __agg FROM ${escapedTable}`;
-                if (aggOptions?.where) {
-                    const whereQuery = dialect.buildSelectQuery({
-                        tableName: this.tableName,
-                        where: aggOptions.where,
-                    });
-                    const whereMatch = dialect
-                        .replaceReplacements(whereQuery.sql, whereQuery.values)
-                        .match(/WHERE (.+)$/i);
-                    if (whereMatch)
-                        sql += ` WHERE ${whereMatch[1]}`;
-                }
-                const result = await dialect.query(sql);
-                const val = result.rows[0]?.__agg;
-                return val !== null && val !== undefined ? Number(val) : null;
+            async min(attribute, aggOptions = {}) {
+                return self._aggregate(model, modelName, 'MIN', attribute, this._mergeScopes(aggOptions));
             },
-            async sum(attribute, aggOptions) {
-                if (!self.dialect)
-                    throw new Error('Database not connected');
-                const dialect = self.dialect;
-                const escapedAttr = dialect.escapeId(attribute);
-                const escapedTable = dialect.escapeId(this.tableName);
-                let sql = `SELECT SUM(${escapedAttr}) AS __agg FROM ${escapedTable}`;
-                if (aggOptions?.where) {
-                    const whereQuery = dialect.buildSelectQuery({
-                        tableName: this.tableName,
-                        where: aggOptions.where,
-                    });
-                    const whereMatch = dialect
-                        .replaceReplacements(whereQuery.sql, whereQuery.values)
-                        .match(/WHERE (.+)$/i);
-                    if (whereMatch)
-                        sql += ` WHERE ${whereMatch[1]}`;
-                }
-                const result = await dialect.query(sql);
-                const val = result.rows[0]?.__agg;
-                return val !== null && val !== undefined ? Number(val) : 0;
+            async sum(attribute, aggOptions = {}) {
+                return (await self._aggregate(model, modelName, 'SUM', attribute, this._mergeScopes(aggOptions)));
+            },
+            /** Arithmetic mean of a column. Returns null when no rows match. */
+            async avg(attribute, aggOptions = {}) {
+                return self._aggregate(model, modelName, 'AVG', attribute, this._mergeScopes(aggOptions));
             },
             async upsert(values, upsertOptions) {
                 if (!self.dialect) {
@@ -6392,6 +6396,67 @@ $$ LANGUAGE plpgsql;`;
         const raw = rows[0].count ?? rows[0].COUNT ?? Object.values(rows[0])[0];
         return Number(raw) || 0;
     }
+    /**
+     * Run a single-value aggregate (MAX/MIN/SUM/AVG) for a model.
+     *
+     * `max`/`min`/`sum` each carried their own copy of this, built the WHERE by
+     * rendering a throwaway SELECT and pulling the clause back out with
+     * `/WHERE (.+)$/` — which breaks on any condition containing the word WHERE
+     * (a subquery, or a string value) — and none of them honored paranoid
+     * filtering, scopes, or filtering includes, so an aggregate could silently
+     * include soft-deleted rows that `findAll` excluded.
+     */
+    async _aggregate(model, modelName, aggregate, attribute, options = {}) {
+        if (!this.dialect) {
+            throw new Error('Database not connected');
+        }
+        const dialect = this.dialect;
+        if (!model.rawAttributes?.[attribute]) {
+            const known = Object.keys(model.rawAttributes || {}).join(', ');
+            throw new Error(`${modelName} has no attribute '${attribute}' to ${aggregate.toLowerCase()}.` +
+                (known ? ` Known attributes: ${known}.` : ''));
+        }
+        const modelOptions = model.options;
+        const deletedAt = modelOptions?.deletedAt || 'deletedAt';
+        let where = options.where;
+        if (modelOptions?.paranoid === true &&
+            options.paranoid !== false &&
+            model.rawAttributes?.[deletedAt]) {
+            where = { ...where, [deletedAt]: { $isNull: true } };
+        }
+        // Filtering includes restrict the aggregated set, as they do for findAll.
+        if (options.include && options.include.length > 0) {
+            for (const rawInclude of options.include) {
+                const filter = await (0, eager_load_1.resolveRequiredIncludeFilter)(this.eagerLoadContext(), model, modelName, rawInclude);
+                if (!filter)
+                    continue;
+                if (filter.values.length === 0)
+                    return aggregate === 'SUM' ? 0 : null;
+                const existing = where?.[filter.parentAttr];
+                where = {
+                    ...where,
+                    [filter.parentAttr]: existing
+                        ? { $and: [existing, { $in: filter.values }] }
+                        : { $in: filter.values },
+                };
+            }
+        }
+        const qualified = model.schema
+            ? `${dialect.escapeId(model.schema)}.${dialect.escapeId(model.tableName)}`
+            : dialect.escapeId(model.tableName);
+        let sql = `SELECT ${aggregate}(${dialect.escapeId(attribute)}) AS ${dialect.escapeId('__agg')} FROM ${qualified}`;
+        let values = [];
+        if (where && Object.keys(where).length > 0) {
+            const built = dialect.buildWhereClause((0, operators_1.normalizeOperatorKeys)(where));
+            sql += ` WHERE ${built.sql}`;
+            values = built.values;
+        }
+        const result = await dialect.query(dialect.replaceReplacements(sql, values));
+        const val = result.rows?.[0]?.__agg;
+        if (val === null || val === undefined)
+            return aggregate === 'SUM' ? 0 : null;
+        return Number(val);
+    }
     /**
      * The view of this instance that the shared eager-loader needs.
      */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ts-prorm-orm",
-  "version": "1.2.1",
+  "version": "1.2.2",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "author": "Malcolm Stone",
@@ -28,7 +28,8 @@
       "import": "./dist/index.js",
       "require": "./dist/index.js",
       "types": "./dist/index.d.ts"
-    }
+    },
+    "./package.json": "./package.json"
   },
   "scripts": {
     "build": "tsc",