web_plsql 0.15.1 → 0.17.0

package/src/handler/plsql/procedure.js

@@ -18,6 +18,7 @@ import {sendResponse} from './sendResponse.js';
 import {ProcedureError} from './procedureError.js';
 import {inspect, getBlock} from '../../util/trace.js';
 import {errorToString} from '../../util/errorToString.js';
+import {sanitizeProcName} from './procedureSanitize.js';
 
 /**
  * @typedef {import('express').Request} Request
@@ -32,69 +33,191 @@ import {errorToString} from '../../util/errorToString.js';
  */
 
 /**
- * Get the SQL statement to execute when a new procedure is invoked
+ *	Get the procedure and arguments to execute
+ *	@param {Request} req - The req object represents the HTTP request. (only used for debugging)
+ *	@param {string} procName - The procedure to execute
+ *	@param {argObjType} argObj - The arguments to pass to the procedure
+ *	@param {configPlSqlHandlerType} options - The options for the middleware
+ *	@param {Connection} databaseConnection - The database connection
+ *	@returns {Promise<{sql: string; bind: BindParameterConfig}>} - The SQL statement and bindings for the procedure to execute
+ */
+const getProcedure = async (req, procName, argObj, options, databaseConnection) => {
+	// path alias
+	if (options.pathAlias?.toLowerCase() === procName.toLowerCase()) {
+		debug(`getProcedure: path alias "${options.pathAlias}" redirects to "${options.pathAliasProcedure}"`);
+		return {
+			sql: `${options.pathAliasProcedure}(p_path=>:p_path)`,
+			bind: {
+				p_path: {dir: oracledb.BIND_IN, type: oracledb.STRING, val: procName},
+			},
+		};
+	}
+
+	// check if we use variable arguments
+	const useVariableArguments = procName.startsWith('!');
+
+	// sanitize procedure name
+	const sanitizedProcName = await sanitizeProcName(useVariableArguments ? procName.substring(1) : procName, databaseConnection, options);
+
+	// run procedure
+	if (useVariableArguments) {
+		return getProcedureVariable(req, sanitizedProcName, argObj);
+	} else {
+		return await getProcedureNamed(req, sanitizedProcName, argObj, databaseConnection);
+	}
+};
+
+/**
+ * Prepare procedure
  *
  * NOTE:
  * 	1) dbms_session.modify_package_state(dbms_session.reinitialize) is used to ensure a stateless environment by resetting package state (dbms_session.reset_package)
  *
- * @param {string} procedure - The procedure
- * @returns {string} - The SQL statement to execute
+ * @param {environmentType} cgiObj - The cgi of the procedure to invoke.
+ * @param {Connection} databaseConnection - Database connection.
+ * @returns {Promise<void>} Promise resolving to void.
  */
-const getProcedureSQL = (procedure) => `
-DECLARE
-	l_file_type		VARCHAR2(32767);
-	l_file_size		INTEGER;
-	l_file_exists	INTEGER := 0;
-BEGIN
-	dbms_session.modify_package_state(dbms_session.reinitialize);
-	owa.init_cgi_env(:cgicount, :cginames, :cgivalues);
-	htp.init;
-	htp.HTBUF_LEN := :htbuflen;
+const procedurePrepare = async (cgiObj, databaseConnection) => {
+	let sqlStatement = 'BEGIN dbms_session.modify_package_state(dbms_session.reinitialize); END;';
+	try {
+		await databaseConnection.execute(sqlStatement);
+	} catch (err) {
+		throw new ProcedureError(`Error when preparing procedure\n${errorToString(err)}`, cgiObj, sqlStatement, {});
+	}
 
-	BEGIN
-		${procedure}
-	EXCEPTION WHEN OTHERS THEN
-		raise_application_error(-20000, 'Error executing "${procedure}"', TRUE);
-	END;
+	// htbuf_len: reduce this limit based on your worst-case character size.
+	// For most character sets, this will be 2 bytes per character, so the limit would be 127.
+	// For UTF8 Unicode, it's 3 bytes per character, meaning the limit should be 85.
+	// For the newer AL32UTF8 Unicode, it's 4 bytes per character, and the limit should be 63.
+	sqlStatement = 'BEGIN owa.init_cgi_env(:cgicount, :cginames, :cgivalues); htp.init; htp.htbuf_len := 63; END;';
+	/** @type {BindParameterConfig} */
+	const bindParameter = {
+		cgicount: {dir: oracledb.BIND_IN, type: oracledb.NUMBER, val: Object.keys(cgiObj).length},
+		cginames: {dir: oracledb.BIND_IN, type: oracledb.STRING, val: Object.keys(cgiObj)},
+		cgivalues: {dir: oracledb.BIND_IN, type: oracledb.STRING, val: Object.values(cgiObj)},
+	};
+	try {
+		await databaseConnection.execute(sqlStatement, bindParameter);
+	} catch (err) {
+		throw new ProcedureError(`Error when preparing procedure\n${errorToString(err)}`, cgiObj, sqlStatement, bindParameter);
+	}
+};
+
+/**
+ * Execute procedure
+ *
+ * @param {{sql: string; bind: BindParameterConfig}} para - The statement and binding to use when executing the procedure.
+ * @param {Connection} databaseConnection - Database connection.
+ * @returns {Promise<void>} Promise resolving to void.
+ */
+const procedureExecute = async (para, databaseConnection) => {
+	const sqlStatement = `BEGIN ${para.sql}; END;`;
+
+	try {
+		await databaseConnection.execute(sqlStatement, para.bind);
+	} catch (err) {
+		throw new ProcedureError(`Error when executing procedure:\n${sqlStatement}\n${errorToString(err)}`, {}, para.sql, para.bind);
+	}
+};
+
+/**
+ * Get page from procedure
+ *
+ * @param {boolean} test - Test.
+ * @param {Connection} databaseConnection - Database connection.
+ * @returns {Promise<string>} Promise resolving to the returned page content.
+ */
+const procedureGetPage = async (test, databaseConnection) => {
+	const MAX_IROWS = 100000;
+
+	/** @type {BindParameterConfig} */
+	const bindParameter = {
+		lines: {dir: oracledb.BIND_OUT, type: oracledb.STRING, maxArraySize: MAX_IROWS},
+		irows: {dir: oracledb.BIND_INOUT, type: oracledb.NUMBER, val: MAX_IROWS},
+	};
+
+	const sqlStatement = 'BEGIN owa.get_page(thepage=>:lines, irows=>:irows); END;';
+
+	/** @type {Result} */
+	let result = {};
+	try {
+		result = await databaseConnection.execute(sqlStatement, bindParameter);
+	} catch (err) {
+		if (debug.enabled) {
+			debug(getBlock('results', inspect(result)));
+		}
+
+		throw new ProcedureError(`Error when getting page returned by procedure\n${errorToString(err)}`, {}, sqlStatement, bindParameter);
+	}
+
+	const {lines, irows} = z.object({irows: z.number(), lines: z.array(z.string())}).parse(result.outBinds);
+
+	// Make sure that we have retrieved all the rows
+	if (irows > MAX_IROWS) {
+		/* istanbul ignore next */
+		throw new ProcedureError(`Error when retrieving rows. irows="${irows}"`, {}, sqlStatement, bindParameter);
+	}
+
+	return lines.join('');
+};
+
+/**
+ * Download files from procedure
+ *
+ * @param {oracledb.Lob} fileBlob - The blob eventually containing the file.
+ * @param {Connection} databaseConnection - Database connection.
+ * @returns {Promise<{fileType: string, fileSize: number, fileBlob: stream.Readable | null}>} Promise resolving to the result.
+ */
+const procedureDownloadFiles = async (fileBlob, databaseConnection) => {
+	/** @type {BindParameterConfig} */
+	const bindParameter = {
+		fileType: {dir: oracledb.BIND_OUT, type: oracledb.STRING},
+		fileSize: {dir: oracledb.BIND_OUT, type: oracledb.NUMBER},
+		fileBlob: {dir: oracledb.BIND_INOUT, type: oracledb.BLOB, val: fileBlob},
+	};
 
+	const sqlStatement = `
+DECLARE
+	l_file_type		VARCHAR2(32767)	:= '';
+	l_file_size		INTEGER			:= 0;
+BEGIN
 	IF (wpg_docload.is_file_download()) THEN
 		wpg_docload.get_download_file(l_file_type);
 		IF (l_file_type = 'B') THEN
-			l_file_exists := 1;
 			wpg_docload.get_download_blob(:fileBlob);
 			l_file_size := dbms_lob.getlength(:fileBlob);
 		END IF;
 	END IF;
-	:fileExist := l_file_exists;
 	:fileType := l_file_type;
 	:fileSize := l_file_size;
-
-	owa.get_page(thepage=>:lines, irows=>:irows);
 END;
 `;
 
-/**
- *	Get the procedure and arguments to execute
- *	@param {string} procName - The procedure to execute
- *	@param {argObjType} argObj - The arguments to pass to the procedure
- *	@param {configPlSqlHandlerType} options - The options for the middleware
- *	@param {Connection} databaseConnection - The database connection
- *	@returns {Promise<{sql: string; bind: BindParameterConfig}>} - The SQL statement and bindings for the procedure to execute
- */
-const getProcedure = async (procName, argObj, options, databaseConnection) => {
-	if (options.pathAlias && options.pathAlias.toLowerCase() === procName.toLowerCase()) {
-		debug(`getProcedure: path alias "${options.pathAlias}" redirects to "${options.pathAliasProcedure}"`);
-		return {
-			sql: `${options.pathAliasProcedure}(p_path=>:p_path);`,
-			bind: {
-				p_path: {dir: oracledb.BIND_IN, type: oracledb.STRING, val: procName},
-			},
-		};
-	} else if (procName.startsWith('!')) {
-		return await getProcedureVariable(procName.substring(1), argObj, databaseConnection, options);
+	/** @type {Result | null} */
+	let result = null;
+	try {
+		result = await databaseConnection.execute(sqlStatement, bindParameter);
+	} catch (err) {
+		if (debug.enabled) {
+			debug(getBlock('results', inspect(result)));
+		}
+
+		throw new ProcedureError(`Error when downloading files of procedure\n${errorToString(err)}`, {}, sqlStatement, bindParameter);
 	}
 
-	return await getProcedureNamed(procName, argObj, databaseConnection, options);
+	return z
+		.object({
+			fileType: z
+				.string()
+				.nullable()
+				.transform((val) => val ?? ''),
+			fileSize: z
+				.number()
+				.nullable()
+				.transform((val) => val ?? 0),
+			fileBlob: z.instanceof(stream.Readable).nullable(),
+		})
+		.parse(result.outBinds);
 };
 
 /**
@@ -112,10 +235,8 @@ const getProcedure = async (procName, argObj, options, databaseConnection) => {
 export const invokeProcedure = async (req, res, argObj, cgiObj, filesToUpload, options, databaseConnection) => {
 	debug('invokeProcedure: ENTER');
 
-	const procName = req.params.name;
-
 	//
-	// 1) UPLOAD FILES
+	// UPLOAD FILES
 	//
 
 	debug(`invokeProcedure: upload "${filesToUpload.length}" files`);
@@ -130,119 +251,67 @@ export const invokeProcedure = async (req, res, argObj, cgiObj, filesToUpload, o
 	}
 
 	//
-	// 2) GET SQL STATEMENT AND ARGUMENTS
+	// GET SQL STATEMENT AND ARGUMENTS
 	//
 
-	const para = await getProcedure(procName, argObj, options, databaseConnection);
+	const para = await getProcedure(req, req.params.name, argObj, options, databaseConnection);
 
 	//
-	//	3) EXECUTE PROCEDURE
+	//	PROCEDURE PREPARE
 	//
 
-	const HTBUF_LEN = 63;
-	const MAX_IROWS = 100000;
-
-	const cgi = {
-		keys: Object.keys(cgiObj),
-		values: Object.values(cgiObj),
-	};
+	await procedurePrepare(cgiObj, databaseConnection);
 
-	const fileBlob = await databaseConnection.createLob(oracledb.BLOB);
+	//
+	//	PROCEDURE EXECUTE
+	//
 
-	/** @type {BindParameterConfig} */
-	const bind = {
-		cgicount: {dir: oracledb.BIND_IN, type: oracledb.NUMBER, val: cgi.keys.length},
-		cginames: {dir: oracledb.BIND_IN, type: oracledb.STRING, val: cgi.keys},
-		cgivalues: {dir: oracledb.BIND_IN, type: oracledb.STRING, val: cgi.values},
-		htbuflen: {dir: oracledb.BIND_IN, type: oracledb.NUMBER, val: HTBUF_LEN},
-		fileExist: {dir: oracledb.BIND_OUT, type: oracledb.NUMBER},
-		fileType: {dir: oracledb.BIND_OUT, type: oracledb.STRING},
-		fileSize: {dir: oracledb.BIND_OUT, type: oracledb.NUMBER},
-		fileBlob: {dir: oracledb.BIND_INOUT, type: oracledb.BLOB, val: fileBlob},
-		lines: {dir: oracledb.BIND_OUT, type: oracledb.STRING, maxSize: HTBUF_LEN * 2, maxArraySize: MAX_IROWS},
-		irows: {dir: oracledb.BIND_INOUT, type: oracledb.NUMBER, val: MAX_IROWS},
-	};
+	await procedureExecute(para, databaseConnection);
 
-	// execute procedure and retrieve page
-	const sqlStatement = getProcedureSQL(para.sql);
-	/** @type {Result | null} */
-	let result = null;
-	const bindParams = Object.assign({}, bind, para.bind);
-	try {
-		if (debug.enabled) {
-			if (debug.enabled) {
-				debug(getBlock('execute', sqlStatement));
-				// NOTE: Because inspecting a BLOB value generates a craxy amount of text, we somply remove it.
-				const temp = Object.assign({}, bindParams);
-				delete temp.fileBlob.val;
-				debug(getBlock('bindParams', inspect(temp)));
-			}
-		}
-		result = await databaseConnection.execute(sqlStatement, bindParams);
-	} catch (err) {
-		if (debug.enabled) {
-			debug(getBlock('results', inspect(result)));
-		}
+	//
+	//	PROCEDURE GET PAGE
+	//
 
-		throw new ProcedureError(`Error when executing procedure\n${sqlStatement}\n${errorToString(err)}`, cgiObj, para.sql, para.bind);
+	const lines = await procedureGetPage(true, databaseConnection);
+	if (debug.enabled) {
+		debug(getBlock('data', lines));
 	}
 
 	//
-	//	4) PROCESS RESULTS
+	//	PROCEDURE DOWNLOAD FILE
 	//
 
-	// validate results
-	const data = z
-		.object({
-			irows: z.number(),
-			lines: z.array(z.string()),
-			fileExist: z.number(),
-			fileType: z.string().nullable(),
-			fileSize: z.number().nullable(),
-			fileBlob: z.instanceof(stream.Readable).nullable(),
-		})
-		.parse(result.outBinds);
-
+	const fileBlob = await databaseConnection.createLob(oracledb.BLOB);
+	const fileDownload = await procedureDownloadFiles(fileBlob, databaseConnection);
 	if (debug.enabled) {
-		debug(getBlock('data', inspect(data)));
+		debug(getBlock('data', inspect(fileDownload)));
 	}
 
-	// Make sure that we have retrieved all the rows
-	if (data.irows > MAX_IROWS) {
-		/* istanbul ignore next */
-		throw new ProcedureError(`Error when retrieving rows. irows="${data.irows}"`, cgiObj, para.sql, para.bind);
-	}
-
-	// combine page
-	const pageContent = data.lines.join('');
-
 	//
-	//	6) PARSE PAGE
+	//	PARSE PAGE
 	//
 
 	// parse what we received from PL/SQL
-	const pageComponents = parsePage(pageContent);
+	const pageComponents = parsePage(lines);
 
 	// add "Server" header
 	pageComponents.head.server = cgiObj.SERVER_SOFTWARE;
 
 	// add file download information
-	if (data.fileExist === 1) {
-		pageComponents.file.fileType = data.fileType;
-		pageComponents.file.fileSize = data.fileSize;
-		if (data.fileBlob) {
-			pageComponents.file.fileBlob = await streamToBuffer(data.fileBlob);
-		}
+	if (fileDownload.fileType !== '' && fileDownload.fileSize > 0 && fileDownload.fileBlob !== null) {
+		pageComponents.file.fileType = fileDownload.fileType;
+		pageComponents.file.fileSize = fileDownload.fileSize;
+		pageComponents.file.fileBlob = await streamToBuffer(fileDownload.fileBlob);
 	}
 
 	//
-	//	5) SEND THE RESPONSE
+	//	SEND THE RESPONSE
 	//
 
 	sendResponse(req, res, pageComponents);
 
 	//
-	//	6) CLEANUP
+	//	CLEANUP
 	//
 
 	fileBlob.destroy();

package/src/handler/plsql/procedureNamed.js

@@ -7,21 +7,21 @@ const debug = debugModule('webplsql:procedureNamed');
 
 import oracledb from 'oracledb';
 import z from 'zod';
-import {sanitizeProcName} from './procedureSanitize.js';
 import {RequestError} from './requestError.js';
 import {errorToString} from '../../util/errorToString.js';
+import {stringToNumber} from '../../util/util.js';
+import {toTable, warningMessage} from '../../util/trace.js';
 
 /**
- * @typedef {Record<string, string>} argsType
- * @typedef {{hitCount: number, args: argsType}} cacheEntryType
- */
-
-/**
+ * @typedef {import('express').Request} Request
  * @typedef {import('oracledb').Connection} Connection
  * @typedef {import('oracledb').Result<unknown>} Result
  * @typedef {import('../../types.js').configPlSqlHandlerType} configPlSqlHandlerType
  * @typedef {import('../../types.js').argObjType} argObjType
  * @typedef {import('../../types.js').BindParameterConfig} BindParameterConfig
+ * @typedef {import('../../types.js').BindParameter} BindParameter
+ * @typedef {Record<string, string>} argsType
+ * @typedef {{hitCount: number, args: argsType}} cacheEntryType
  */
 
 const SQL_GET_ARGUMENT = [
@@ -42,6 +42,24 @@ const SQL_GET_ARGUMENT = [
 	'END;',
 ].join('\n');
 
+const DATA_TYPES = Object.freeze({
+	VARCHAR2: 'VARCHAR2',
+	CHAR: 'CHAR',
+	BINARY_INTEGER: 'BINARY_INTEGER',
+	NUMBER: 'NUMBER',
+	DATE: 'DATE',
+	CLOB: 'CLOB',
+	PL_SQL_TABLE: 'PL/SQL TABLE',
+	//	PL/SQL BOOLEAN
+	//	PL/SQL RECORD
+	//	OBJECT
+	//	TABLE
+	//	BLOB
+	//	RAW
+	//	VARRAY
+	//	REF CURSOR
+});
+
 // NOTE: Consider using a separate cache for each database pool to avoid possible conflicts.
 /** @type {Map<string, cacheEntryType>} */
 const ARGS_CACHE = new Map();
@@ -137,8 +155,6 @@ const removeLowestHitCountEntries = (count) => {
  *	@returns {Promise<argsType>} - The argument types
  */
 const findArguments = async (procedure, databaseConnection) => {
-	// calculate the key
-	//const key = `${databaseConnection.connectString}_${databaseConnection.user}_${procedure.toUpperCase()}`;
 	const key = procedure.toUpperCase();
 
 	// lookup in the cache
@@ -174,60 +190,113 @@ const findArguments = async (procedure, databaseConnection) => {
 };
 
 /**
- * Get the sql statement and bindings for the procedure to execute for a fixed number of arguments
- * @param {string} procName - The procedure to execute
- * @param {argObjType} argObj - The arguments to pass to the procedure
- * @param {Connection} databaseConnection - The database connection
- * @param {configPlSqlHandlerType} options - the options for the middleware.
- * @returns {Promise<{sql: string; bind: BindParameterConfig}>} - The SQL statement and bindings for the procedure to execute
+ *	Get the bindling for an argument.
+ *	@param {string} argName - The argument name.
+ *	@param {unknown} argValue - The argument value.
+ *	@param {string} argType - The argument type.
+ *	@returns {BindParameter} - The binding.
  */
-export const getProcedureNamed = async (procName, argObj, databaseConnection, options) => {
-	if (debug.enabled) {
-		debug(`getProcedureNamed: ${procName} arguments=`, argObj);
+export const getBinding = (argName, argValue, argType) => {
+	if (argType === DATA_TYPES.VARCHAR2 || argType === DATA_TYPES.CHAR) {
+		return {dir: oracledb.BIND_IN, type: oracledb.DB_TYPE_VARCHAR, val: argValue};
 	}
 
-	/** @type {BindParameterConfig} */
-	const bind = {};
-	let index = 0;
+	if (argType === DATA_TYPES.CLOB) {
+		return {dir: oracledb.BIND_IN, type: oracledb.DB_TYPE_CLOB, val: argValue};
+	}
 
-	const sanitizedProcName = await sanitizeProcName(procName, databaseConnection, options);
-	const argTypes = await findArguments(sanitizedProcName, databaseConnection);
+	if (argType === DATA_TYPES.NUMBER || argType === DATA_TYPES.BINARY_INTEGER) {
+		const value = stringToNumber(argValue);
+		if (value === null) {
+			throw new Error(`Error in named parameter "${argName}": invalid value "${argValue}" for type "${argType}"`);
+		}
+
+		return {dir: oracledb.BIND_IN, type: oracledb.DB_TYPE_NUMBER, val: value};
+	}
+
+	if (argType === DATA_TYPES.DATE) {
+		if (typeof argValue !== 'string') {
+			throw new Error(`Error in named parameter "${argName}": invalid value "${argValue}" for type "${argType}"`);
+		}
+		const value = new Date(argValue);
+		if (Number.isNaN(value.getTime())) {
+			throw new Error(`Error in named parameter "${argName}": invalid value "${argValue}" for type "${argType}"`);
+		}
+
+		return {dir: oracledb.BIND_IN, type: oracledb.DB_TYPE_VARCHAR, val: value};
+	}
+
+	if (argType === DATA_TYPES.PL_SQL_TABLE || Array.isArray(argValue)) {
+		const value = typeof argValue === 'string' ? [argValue] : argValue;
+
+		return {dir: oracledb.BIND_IN, type: oracledb.DB_TYPE_DATE, val: value};
+	}
+
+	throw new Error(`Error in named parameter "${argName}": invalid binding type "${argType}"`);
+};
+
+/**
+ *	Get binding table for tracing.
+ *	@param {argObjType} argObj - The arguments to pass to the procedure
+ *	@param {argsType} argTypes - The argument types.
+ *	@returns {string} - The text.
+ */
+const inspectBindings = (argObj, argTypes) => {
+	const rows = Object.entries(argObj).map(([key, value]) => {
+		return [key, value.toString(), typeof value, argTypes[key.toLowerCase()]];
+	});
+
+	const {text} = toTable(['id', 'value', 'value type', 'argument type'], rows);
+
+	return text;
+};
+
+/**
+ *	Get the sql statement and bindings for the procedure to execute for a fixed number of arguments
+ *	@param {Request} req - The req object represents the HTTP request. (only used for debugging)
+ *	@param {string} procName - The procedure to execute
+ *	@param {argObjType} argObj - The arguments to pass to the procedure
+ *	@param {Connection} databaseConnection - The database connection
+ *	@returns {Promise<{sql: string; bind: BindParameterConfig}>} - The SQL statement and bindings for the procedure to execute
+ */
+export const getProcedureNamed = async (req, procName, argObj, databaseConnection) => {
+	debug(`getProcedureNamed: ${procName} arguments=`, argObj);
+
+	// get the types of the arguments
+	const argTypes = await findArguments(procName, databaseConnection);
+
+	/** @type {string[]} */
+	const sqlParameter = [];
+
+	/** @type {BindParameterConfig} */
+	const bindings = {};
 
 	// bindings for the statement
-	let sql = `${sanitizedProcName}(`;
 	for (const key in argObj) {
-		const value = argObj[key];
 		const parameterName = `p_${key}`;
-
-		// prepend the separator, if this is not the first argument
-		if (index > 0) {
-			sql += ',';
-		}
-		index++;
-
-		// add the argument
-		sql += `${key}=>:${parameterName}`;
-
-		// add the binding
-		bind[parameterName] = {dir: oracledb.BIND_IN, type: oracledb.STRING};
-
-		// set the value or array of values
-		if (Array.isArray(value) || argTypes[key] === 'PL/SQL TABLE') {
-			/** @type {string[]} */
-			const val = [];
-			if (typeof value === 'string') {
-				val.push(value);
-			} else {
-				value.forEach((element) => {
-					val.push(element);
-				});
-			}
-			bind[parameterName].val = val;
-		} else if (typeof value === 'string') {
-			bind[parameterName].val = value;
+		const argValue = argObj[key];
+		const argType = argTypes[key.toLowerCase()];
+		/** @type {BindParameter} */
+		let bind = {dir: oracledb.BIND_IN, type: oracledb.DB_TYPE_VARCHAR, val: argValue};
+
+		if (argType) {
+			bind = getBinding(key, argValue, argType);
+		} else {
+			const text = inspectBindings(argObj, argTypes);
+			warningMessage({type: 'warning', message: `Error in named parameter "${key}": invalid binding type "${argType}"\n\n${text}`, req});
 		}
+
+		sqlParameter.push(`${key}=>:${parameterName}`);
+		bindings[parameterName] = bind;
+	}
+
+	// select statement
+	const sql = `${procName}(${sqlParameter.join(', ')})`;
+
+	if (debug.enabled) {
+		debug(sql);
+		debug(inspectBindings(argObj, argTypes));
 	}
-	sql += ');';
 
-	return {sql, bind};
+	return {sql, bind: bindings};
 };

package/src/handler/plsql/procedureVariable.js

@@ -6,9 +6,9 @@ import debugModule from 'debug';
 const debug = debugModule('webplsql:procedureVariable');
 
 import oracledb from 'oracledb';
-import {sanitizeProcName} from './procedureSanitize.js';
 
 /**
+ * @typedef {import('express').Request} Request
  * @typedef {import('oracledb').Connection} Connection
  * @typedef {import('oracledb').Result<unknown>} Result
  * @typedef {import('../../types.js').configPlSqlHandlerType} configPlSqlHandlerType
@@ -17,14 +17,13 @@ import {sanitizeProcName} from './procedureSanitize.js';
  */
 
 /**
- * Get the sql statement and bindings for the procedure to execute for a variable number of arguments
- * @param {string} procName - The procedure to execute
- * @param {argObjType} argObj - The arguments to pass to the procedure
- * @param {Connection} databaseConnection - The database connection
- * @param {configPlSqlHandlerType} options - the options for the middleware.
- * @returns {Promise<{sql: string; bind: BindParameterConfig}>} - The SQL statement and bindings for the procedure to execute
+ *	Get the sql statement and bindings for the procedure to execute for a variable number of arguments
+ *	@param {Request} req - The req object represents the HTTP request. (only used for debugging)
+ *	@param {string} procName - The procedure to execute
+ *	@param {argObjType} argObj - The arguments to pass to the procedure
+ *	@returns {{sql: string; bind: BindParameterConfig}} - The SQL statement and bindings for the procedure to execute
  */
-export const getProcedureVariable = async (procName, argObj, databaseConnection, options) => {
+export const getProcedureVariable = (req, procName, argObj) => {
 	if (debug.enabled) {
 		debug(`getProcedureVariable: ${procName} arguments=`, argObj);
 	}
@@ -45,10 +44,8 @@ export const getProcedureVariable = async (procName, argObj, databaseConnection,
 		}
 	}
 
-	const sanitizedProcName = await sanitizeProcName(procName, databaseConnection, options);
-
 	return {
-		sql: `${sanitizedProcName}(:argnames, :argvalues);`,
+		sql: `${procName}(:argnames, :argvalues)`,
 		bind: {
 			argnames: {dir: oracledb.BIND_IN, type: oracledb.STRING, val: names},
 			argvalues: {dir: oracledb.BIND_IN, type: oracledb.STRING, val: values},

package/src/server/version.js

@@ -2,4 +2,4 @@
  * Returns the current library version
  * @returns {string} - Version.
  */
-export const getVersion = () => '0.15.1';
+export const getVersion = () => '0.17.0';