fix (DAL): parametrized squel queries (#438)

Changes to the query builder of the DAL to use squel's support for
parametrized queries.

.changeset/quiet-garlics-compare.md

@@ -0,0 +1,5 @@
+---
+"electric-sql": patch
+---
+
+Use parametrized SQL queries.

clients/typescript/src/client/execution/db.ts

@@ -12,22 +12,11 @@ import { Row, Statement } from '../../util'
  * some underlying drivers do not support promises.
  */
 export interface DB {
-  run(
-    statement: string,
-    successCallback?: (tx: DB, res: RunResult) => void,
-    errorCallback?: (error: any) => void
-  ): void
   run(
     statement: QueryBuilder,
     successCallback?: (tx: DB, res: RunResult) => void,
     errorCallback?: (error: any) => void
   ): void
-  query<Z>(
-    statement: string,
-    schema: z.ZodType<Z>,
-    successCallback: (tx: DB, res: Z[]) => void,
-    errorCallback?: (error: any) => void
-  ): void
   query<Z>(
     statement: QueryBuilder,
     schema: z.ZodType<Z>,

clients/typescript/src/client/execution/nonTransactionalDB.ts

@@ -8,12 +8,13 @@ export class NonTransactionalDB implements DB {
   constructor(private _adapter: DatabaseAdapter) {}
 
   run(
-    statement: string | QueryBuilder,
+    statement: QueryBuilder,
     successCallback?: (db: DB, res: RunResult) => void,
     errorCallback?: (error: any) => void
   ) {
+    const { text, values } = statement.toParam({ numberedParameters: false })
     this._adapter
-      .run({ sql: statement.toString() })
+      .run({ sql: text, args: values })
       .then((res) => {
         if (typeof successCallback !== 'undefined') {
           try {
@@ -33,13 +34,14 @@ export class NonTransactionalDB implements DB {
   }
 
   query<Z>(
-    statement: string | QueryBuilder,
+    statement: QueryBuilder,
     schema: z.ZodType<Z>,
     successCallback: (db: DB, res: Z[]) => void,
     errorCallback?: (error: any) => void
   ) {
+    const { text, values } = statement.toParam({ numberedParameters: false })
     this._adapter
-      .query({ sql: statement.toString() })
+      .query({ sql: text, args: values })
       .then((rows) => {
         try {
           const objects = rows.map((row) => schema.parse(row))

clients/typescript/src/client/execution/transactionalDB.ts

@@ -7,12 +7,13 @@ import { Row, Statement } from '../../util'
 export class TransactionalDB implements DB {
   constructor(private _tx: Transaction) {}
   run(
-    statement: QueryBuilder | string,
+    statement: QueryBuilder,
     successCallback?: (db: DB, res: RunResult) => void,
     errorCallback?: (error: any) => void
   ): void {
+    const { text, values } = statement.toParam({ numberedParameters: false })
     this._tx.run(
-      { sql: statement.toString() },
+      { sql: text, args: values },
       (tx, res) => {
         if (typeof successCallback !== 'undefined')
           successCallback(new TransactionalDB(tx), res)
@@ -22,13 +23,14 @@ export class TransactionalDB implements DB {
   }
 
   query<Z>(
-    statement: QueryBuilder | string,
+    statement: QueryBuilder,
     schema: z.ZodType<Z>,
     successCallback: (db: DB, res: Z[]) => void,
     errorCallback?: (error: any) => void
   ): void {
+    const { text, values } = statement.toParam({ numberedParameters: false })
     this._tx.query(
-      { sql: statement.toString() },
+      { sql: text, args: values },
       (tx, rows) => {
         if (typeof successCallback !== 'undefined') {
           const objects = rows.map((row) => schema.parse(row)) //.partial().parse(row))

clients/typescript/src/squel.d.ts

@@ -0,0 +1,8 @@
+import {} from 'squel'
+
+declare module 'squel' {
+  export interface ToParamOptions {
+    numberedParametersStartAt?: number
+    numberedParameters?: boolean
+  }
+}