feat: strict mode to validate input for INSERT, UPDATE and UPSERT

db-service/lib/SQLService.js

@@ -18,6 +18,26 @@ class SQLService extends DatabaseService {
   init() {
     this.on(['INSERT', 'UPSERT', 'UPDATE'], require('./fill-in-keys')) // REVISIT should be replaced by correct input processing eventually
     this.on(['INSERT', 'UPSERT', 'UPDATE'], require('./deep-queries').onDeep)
+    if (cds.env.features.db_strict) {
+      this.on(['INSERT', 'UPSERT', 'UPDATE'], ({ query }, next) => {
+        const kind = query.kind || Object.keys(query)[0]
+        const operation = query[kind]
+        if (!operation.columns && !operation.entries && !operation.data) return next()
+        const columns =
+          operation.columns ||
+          Object.keys(
+            operation.entries?.reduce((acc, obj) => {
+              return Object.assign(acc, obj)
+            }, {}) || operation.data,
+          )
+        const invalidColumns = columns.filter(c => !query.target?.elements?.[c])
+
+        if (invalidColumns.length > 0) {
+          cds.error(`STRICT MODE: Trying to ${kind} non existent columns (${invalidColumns})`)
+        }
+        return next()
+      })
+    }
     this.on(['SELECT'], this.onSELECT)
     this.on(['INSERT'], this.onINSERT)
     this.on(['UPSERT'], this.onUPSERT)

test/compliance/resources/srv/index.cds

@@ -0,0 +1,5 @@
+using {complex} from '../db/index.cds';
+
+service ComplianceService {
+  entity Books as projection on complex.Books;
+}

test/compliance/strictMode.test.js

@@ -0,0 +1,120 @@
+const cds = require('../cds.js')
+
+describe('strict mode', () => {
+  beforeAll(() => {
+    process.env.cds_features_db__strict = true
+  })
+
+  cds.test(__dirname + '/resources')
+
+  afterAll(() => {
+    process.env.cds_features_db__strict = undefined
+  })
+
+  async function runAndExpectError(cqn, expectedMessage) {
+    let error
+    try {
+      await cds.run(cqn)
+    } catch (e) {
+      error = e
+    }
+    expect(error.message).toEqual(expectedMessage)
+  }
+  describe('UPDATE Scenarios', () => {
+    test('Update with multiple errors', async () => {
+      const { Books } = cds.entities('ComplianceService')
+      await runAndExpectError(
+        UPDATE.entity(Books).where({ ID: 2 }).set({ abc: 'bar', abc2: 'baz' }),
+        'STRICT MODE: Trying to UPDATE non existent columns (abc,abc2)',
+      )
+    })
+
+    test('Update with single error', async () => {
+      const { Books } = cds.entities('ComplianceService')
+      await runAndExpectError(
+        UPDATE.entity(Books).where({ ID: 2 }).set({ abc: 'bar' }),
+        'STRICT MODE: Trying to UPDATE non existent columns (abc)',
+      )
+    })
+
+    test.skip('Update on non existing entity', async () => {
+      await runAndExpectError(
+        UPDATE.entity('notExisting').where({ ID: 2 }).set({ abc: 'bar' }),
+        'STRICT MODE: Trying to UPDATE non existent columns (abc,abc2)',
+      )
+    })
+  })
+
+  describe('INSERT Scenarios', () => {
+    test('Insert with single error using entries', async () => {
+      const { Books } = cds.entities('ComplianceService')
+      await runAndExpectError(
+        INSERT.into(Books).entries({ abc: 'bar' }),
+        'STRICT MODE: Trying to INSERT non existent columns (abc)',
+      )
+    })
+
+    test('Insert with multiple errors using entries', async () => {
+      const { Books } = cds.entities('ComplianceService')
+      await runAndExpectError(
+        INSERT.into(Books).entries([{ abc: 'bar' }, { abc2: 'bar2' }]),
+        'STRICT MODE: Trying to INSERT non existent columns (abc,abc2)',
+      )
+    })
+
+    test('Insert with single error using columns and values', async () => {
+      const { Books } = cds.entities('ComplianceService')
+      await runAndExpectError(
+        INSERT.into(Books).columns(['abc']).values(['foo', 'bar']),
+        'STRICT MODE: Trying to INSERT non existent columns (abc)',
+      )
+    })
+
+    test('Insert with multiple errors with columns and rows', async () => {
+      const { Books } = cds.entities('ComplianceService')
+      await runAndExpectError(
+        INSERT.into(Books).columns(['abc', 'abc2']).rows(['foo', 'bar'], ['foo2', 'bar2'], ['foo3', 'bar3']),
+        'STRICT MODE: Trying to INSERT non existent columns (abc,abc2)',
+      )
+    })
+
+    test('Insert with single error using columns and rows', async () => {
+      const { Books } = cds.entities('ComplianceService')
+      await runAndExpectError(
+        INSERT.into(Books).columns(['abc']).rows(['foo', 'bar'], ['foo2', 'bar2'], ['foo3', 'bar3']),
+        'STRICT MODE: Trying to INSERT non existent columns (abc)',
+      )
+    })
+
+    test('Insert on non existing entity using entries', async () => {
+      await runAndExpectError(
+        INSERT.into('notExisting').entries({ abc: 'bar' }),
+        'STRICT MODE: Trying to INSERT non existent columns (abc)',
+      )
+    })
+  })
+
+  describe('UPSERT Scenarios', () => {
+    test('UPSERT with single error', async () => {
+      const { Books } = cds.entities('ComplianceService')
+      await runAndExpectError(
+        UPSERT.into(Books).entries({ abc: 'bar' }),
+        'STRICT MODE: Trying to UPSERT non existent columns (abc)',
+      )
+    })
+    test('UPSERT with multiple errors', async () => {
+      const { Books } = cds.entities('ComplianceService')
+      await runAndExpectError(
+        UPSERT.into(Books).entries({ abc: 'bar', abc2: 'baz' }),
+        'STRICT MODE: Trying to UPSERT non existent columns (abc,abc2)',
+      )
+    })
+
+    test('UPSERT on non existing entity', async () => {
+      await runAndExpectError(
+        UPSERT.into('notExisting').entries({ abc: 'bar' }),
+        'STRICT MODE: Trying to UPSERT non existent columns (abc)',
+      )
+    })
+  })
+})