Merge pull request #13449 from Budibase/feature/sqs-prepared-statements

SQS prepared statement support

packages/backend-core/src/db/couch/DatabaseImpl.ts

@@ -12,6 +12,7 @@ import {
   isDocument,
   RowResponse,
   RowValue,
+  SqlQueryBinding,
 } from "@budibase/types"
 import { getCouchInfo } from "./connections"
 import { directCouchUrlCall } from "./utils"
@@ -248,14 +249,20 @@ export class DatabaseImpl implements Database {
     })
   }
 
-  async sql<T extends Document>(sql: string): Promise<T[]> {
+  async sql<T extends Document>(
+    sql: string,
+    parameters?: SqlQueryBinding
+  ): Promise<T[]> {
     const dbName = this.name
     const url = `/${dbName}/${SQLITE_DESIGN_DOC_ID}`
     const response = await directCouchUrlCall({
       url: `${this.couchInfo.sqlUrl}/${url}`,
       method: "POST",
       cookie: this.couchInfo.cookie,
-      body: sql,
+      body: {
+        query: sql,
+        args: parameters,
+      },
     })
     if (response.status > 300) {
       throw new Error(await response.text())

packages/backend-core/src/db/instrumentation.ts

@@ -13,6 +13,7 @@ import {
   DatabaseQueryOpts,
   Document,
   RowValue,
+  SqlQueryBinding,
 } from "@budibase/types"
 import tracer from "dd-trace"
 import { Writable } from "stream"
@@ -150,10 +151,13 @@ export class DDInstrumentedDatabase implements Database {
     })
   }
 
-  sql<T extends Document>(sql: string): Promise<T[]> {
+  sql<T extends Document>(
+    sql: string,
+    parameters?: SqlQueryBinding
+  ): Promise<T[]> {
     return tracer.trace("db.sql", span => {
       span?.addTags({ db_name: this.name })
-      return this.db.sql(sql)
+      return this.db.sql(sql, parameters)
     })
   }
 }

packages/server/src/sdk/app/rows/search/sqs.ts

@@ -156,21 +156,21 @@ export async function search(
   try {
     const query = builder._query(request, {
       disableReturning: true,
-      disableBindings: true,
     })
 
     if (Array.isArray(query)) {
       throw new Error("SQS cannot currently handle multiple queries")
     }
 
-    let sql = query.sql
+    let sql = query.sql,
+      bindings = query.bindings
 
     // quick hack for docIds
     sql = sql.replace(/`doc1`.`rowId`/g, "`doc1.rowId`")
     sql = sql.replace(/`doc2`.`rowId`/g, "`doc2.rowId`")
 
     const db = context.getAppDB()
-    const rows = await db.sql<Row>(sql)
+    const rows = await db.sql<Row>(sql, bindings)
 
     return {
       rows: await sqlOutputProcessing(

packages/types/src/sdk/db.ts

@@ -4,6 +4,7 @@ import {
   AnyDocument,
   Document,
   RowValue,
+  SqlQueryBinding,
   ViewTemplateOpts,
 } from "../"
 import { Writable } from "stream"
@@ -143,7 +144,10 @@ export interface Database {
     opts?: DatabasePutOpts
   ): Promise<Nano.DocumentInsertResponse>
   bulkDocs(documents: AnyDocument[]): Promise<Nano.DocumentBulkResponse[]>
-  sql<T extends Document>(sql: string): Promise<T[]>
+  sql<T extends Document>(
+    sql: string,
+    parameters?: SqlQueryBinding
+  ): Promise<T[]>
   allDocs<T extends Document | RowValue>(
     params: DatabaseQueryOpts
   ): Promise<AllDocsResponse<T>>