39 Commits

Include renames

Author	SHA1	Message	Date
warkanum	52d3dca1fa	feat(hooks): add BeforeOp hook and fix BeforeScan row-security gap ... Adds a BeforeOp HookType across resolvespec, restheadspec, websocketspec, mqttspec, and funcspec that fires before every SQL operation (read, create, update, delete, scan/query) via a new ExecuteBeforeOp helper. Also closes a row-level-security gap: resolvespec registered a BeforeScan hook for ApplyRowSecurity but never fired it, and websocketspec/mqttspec had no BeforeScan hook point at all, so row security was never applied to their queries. BeforeScan now fires right before the actual scan in all three, with the (possibly hook-modified) query used for execution.	2026-07-25 11:39:31 +02:00
Hein	a85e572732	fix(hooks): reset Tx to pooled connection for post-commit hook calls ... BeforeScan (restheadspec handleUpdate) and BeforeResponse (funcspec list/single query handlers) fire after RunInTransaction commits, but hookCtx.Tx still pointed at the now-dead transaction. Any hook that executed a query against Tx (e.g. setUserViaContext) failed with "sql: transaction has already been committed or rolled back".	2026-07-20 13:45:13 +02:00
Hein	598fd687f6	feat(security): add GetUserRef method for opaque user identifiers	2026-07-10 13:47:32 +02:00
Hein	4c512acf25	test(function_api): add test for x-detailapi header response	2026-06-23 08:53:33 +02:00
Hein	07a402634e	fix(function_api): enhance detail format with table metadata ... * include table name and prefix in response * add field metadata extraction for raw SQL results	2026-06-23 08:50:29 +02:00
Hein	4018af0636	fix(validation): enhance filter logic for column validation ... * adjust handling of "all" filter to consider filtered columns fix(function_api): improve variable substitution in SQL queries * add safeSubstituteVar for context-aware value sanitization	2026-05-27 12:17:31 +02:00
Hein	c42d09238f	fix: better error detail for failed sql	2026-05-20 13:06:26 +02:00
Hein	85bb0f7874	fix(funcspec): update meta variable replacement in SQL query	2026-05-18 12:13:06 +02:00
Hein	1ebe0d7ac3	fix(funcspec): refine filter application logic for SQL queries ... * update filter checks to only consider SELECT list * add test for function parameters not matching filters	2026-05-15 14:28:12 +02:00
Hein	2ae4d07544	fix(funcspec): remove AllowQueryParamFilters and related logic ... * Simplify SqlQueryOptions by removing AllowQueryParamFilters * Update mergeQueryParams to avoid applying filters for JSON arguments * Add tests for sqlStripStringLiterals and query param handling	2026-05-15 09:25:55 +02:00
Hein	49639b6c19	fix(funcspec): add support for query param filters ... * Introduced AllowQueryParamFilters option in SqlQueryOptions * Implemented applyQueryParamFilters method to handle field filters	2026-05-15 09:07:21 +02:00
Hein	8733176cba	fix(funcspec): enhance quote detection for parameters	2026-05-15 08:26:59 +02:00
Hein	aef1f96c10	fix(db): cast columns to text for LIKE/ILIKE queries	2026-04-13 14:05:17 +02:00
warkanum	79720d5421	feat(security): add BeforeHandle hook for auth checks after model resolution ... - Implement BeforeHandle hook to enforce authentication based on model rules. - Integrate with existing security mechanisms to allow or deny access. - Update documentation to reflect new hook and its usage.	2026-03-01 09:15:30 +02:00
Hein	4bf3d0224e	feat(database): ✨ normalize driver names across adapters ... * Added DriverName method to BunAdapter, GormAdapter, and PgSQLAdapter for consistent driver name handling. * Updated transaction adapters to include driver name. * Enhanced mock database implementations for testing with DriverName method. * Adjusted getTableName functions to accommodate driver-specific naming conventions.	2026-02-05 13:28:53 +02:00
Hein	d8df1bdac2	feat(funcspec): ✨ add JSON and UUID handling in normalization ... * Enhance normalization to support JSON strings as json.RawMessage * Add support for UUID formatting * Maintain existing behavior for other types	2026-01-05 17:56:54 +02:00
Hein	c0c669bd3d	feat(handler): enhance update logic to merge existing records with incoming data	2026-01-05 12:31:01 +02:00
Hein	fae9a082bd	refactor: 🚨 linting issues	2025-12-31 09:37:12 +02:00
copilot-swe-agent[bot]andwarkanum	a6a17d019f	fix: Optimized regex performance and added backslash escaping for LIKE patterns ... - Added backslash escaping to LIKE pattern sanitization - Optimized ValidSQL select mode with single pre-compiled regex - All funcspec tests pass (except pre-existing TestReplaceMetaVariables) Co-authored-by: warkanum <208308+warkanum@users.noreply.github.com>	2025-12-31 07:28:16 +00:00
copilot-swe-agent[bot]andwarkanum	a7cc42044b	fix: Improved SQL injection protection with proper handling ... - Fixed IN clause to conditionally quote only string values (not numeric) - Fixed LIKE pattern sanitization to preserve wildcards while preventing injection - Improved dangerous pattern removal with case-insensitive regex while preserving case - All funcspec tests now pass (except pre-existing TestReplaceMetaVariables) Co-authored-by: warkanum <208308+warkanum@users.noreply.github.com>	2025-12-31 07:24:56 +00:00
copilot-swe-agent[bot]andwarkanum	8cdc353029	fix: Fixed SQL quoting for empty/zero values and sanitized match filter ... - Sanitize colval immediately after extraction in match= filter - Fixed empty/zero value handling to use proper SQL literals (0 vs '') - Applied proper quoting for string vs numeric comparisons - Fixed x-fieldfilter handlers for proper value handling Co-authored-by: warkanum <208308+warkanum@users.noreply.github.com>	2025-12-31 07:22:42 +00:00
copilot-swe-agent[bot]andwarkanum	6528e94297	fix: Improved SQL injection protections based on code review ... - Fixed backslash escaping order in colvalue mode - Added proper quoting for IN clause values - Simplified dangerous pattern matching with case-insensitive approach - All funcspec tests pass (except pre-existing test failure) Co-authored-by: warkanum <208308+warkanum@users.noreply.github.com>	2025-12-31 07:20:56 +00:00
copilot-swe-agent[bot]andwarkanum	f711bf38d2	fix: Enhanced SQL injection protection in funcspec ... - Added sanitization for path parameters in mergePathParams - Added sanitization for query parameters with p- prefix in mergeQueryParams - Added sanitization for header parameters in mergeHeaderParams - Fixed IN clause to sanitize all values individually - Improved ValidSQL function with better escaping and more injection patterns - Added backslash escaping to colvalue mode - Extended dangerous keyword list in select mode Co-authored-by: warkanum <208308+warkanum@users.noreply.github.com>	2025-12-31 07:19:53 +00:00
Hein	caf85cf558	fix: 🔒 Fixed funcapi possible injections	2025-12-31 09:09:16 +02:00
Hein	31ad217818	Event Broken Concept	2025-12-12 09:23:54 +02:00
Hein	7ef1d6424a	Better handling for variables callback	2025-12-11 15:57:01 +02:00
Hein	c50eeac5bf	Change the SqlQuery functions parameters on Function Spec	2025-12-11 15:42:00 +02:00
Hein	dc3b621380	Fixed test for session id changes	2025-12-09 14:07:00 +02:00
Hein	0a9c107095	Fixed sqlquery bug in funcspec	2025-12-09 10:19:03 +02:00
Hein	4e2fe33b77	Fixed session_rid in funcspec	2025-12-09 10:04:39 +02:00
Hein	ab1ce869b6	Handling JSON responses in funcspec	2025-12-03 12:10:13 +02:00
Hein	ff72e04428	Added meta operation.	2025-12-03 11:59:58 +02:00
Hein	e35f8a4f14	Fix session id that is an integer.	2025-12-03 11:49:19 +02:00
Hein	5ff9a8a24e	Fixed blank params on funcspec	2025-12-03 11:42:32 +02:00
Hein	8172c0495d	More generic security solution.	2025-12-02 16:35:08 +02:00
Hein	9c5c7689e9	More common handler interface	2025-12-02 15:45:24 +02:00
Hein	78029fb34f	Fixed formatting issues	2025-12-01 14:56:30 +02:00
Hein	1643a5e920	Added cache, funcspec and implemented total cache	2025-12-01 14:40:54 +02:00
Hein	6bbe0ec8b0	Added function api prototype	2025-11-24 17:00:15 +02:00