fraiseql-cli 2.2.0

CLI tools for FraiseQL v2 - Schema compilation and development utilities
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89

#![allow(clippy::unwrap_used)] // Reason: test/bench code, panics are acceptable
//! Tests for SQL identifier validation at compile time.
//!
//! Ensures `sql_source`, `view_name`, and `function_name` values are safe SQL
//! identifiers, blocking injection attempts before they reach the compiled schema.

use fraiseql_cli::schema::validator::{ErrorSeverity, validate_sql_identifier};

// ============================================================================
// Valid identifiers
// ============================================================================

#[test]
fn valid_simple_identifiers_pass() {
    let cases = [
        "v_user",
        "fn_create_post",
        "v_sales_2024",
        "_internal",
        "Users",
    ];
    for id in cases {
        assert!(validate_sql_identifier(id, "sql_source", "Query.test").is_ok(), "{id}");
    }
}

#[test]
fn valid_schema_qualified_identifiers_pass() {
    let cases = [
        "public.v_user",
        "myschema.fn_create_post",
        "_internal.v_data",
    ];
    for id in cases {
        assert!(validate_sql_identifier(id, "sql_source", "Query.test").is_ok(), "{id}");
    }
}

// ============================================================================
// Invalid identifiers
// ============================================================================

#[test]
fn injection_attempt_rejected() {
    let err =
        validate_sql_identifier("v_user\"; DROP TABLE users; --", "sql_source", "Query.users")
            .unwrap_err();
    assert_eq!(err.severity, ErrorSeverity::Error);
}

#[test]
fn invalid_identifiers_rejected() {
    let cases = [
        ("v_user; DROP TABLE users; --", "semicolon"),
        ("v_user\" OR 1=1--", "embedded quote"),
        ("public..v_user", "double dot"),
        ("123invalid", "starts with digit"),
        ("v user", "space"),
        ("v-user", "dash"),
        ("", "empty string"),
        (".v_user", "leading dot"),
        ("v_user.", "trailing dot"),
    ];
    for (id, reason) in cases {
        assert!(
            validate_sql_identifier(id, "sql_source", "Query.test").is_err(),
            "{reason}: {id}"
        );
    }
}

#[test]
fn error_message_is_actionable() {
    let err = validate_sql_identifier("v_user; DROP TABLE users", "sql_source", "Query.users")
        .unwrap_err();
    assert!(err.message.contains("sql_source"), "should name the field");
    assert!(
        err.message.contains("v_user; DROP TABLE users"),
        "should show the offending value"
    );
    assert!(err.message.contains("valid SQL identifier"), "should explain what's expected");
}

#[test]
fn empty_identifier_error_message() {
    let err = validate_sql_identifier("", "function_name", "Mutation.createUser").unwrap_err();
    assert!(err.message.contains("function_name"));
    assert!(err.message.contains("must not be empty"));
}