-
Notifications
You must be signed in to change notification settings - Fork 300
v3 #259
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
I think the only thing left now is some missing and better documentation for the new features. Would be really great if anyone wants to help with that, since I'm not gonna be able to find a lot of time the next couple of weeks.. |
@porsager how does the new "dynamic query builder based on raw sql" work? I'm very excited about that feature. Thanks! |
It's basically the most simply building block I could come up with for composing static sql safely into queries. I'm also very excited to see what people will come up with using it. The I've also chosen this way to stay as close as possible to actual SQL. Here are some examples for what you can do: // Using sql functions dynamically
sql`
update x set updated_at = ${ now ? sql`now()` : someDate }
`
// Dynamic filters (eg where, and / or usage)
sql`
select
*
from x ${ id
? sql`where user_id = ${ id }`
: sql``
}
`
// Complete queries using with
const other = sql`
select 1 as a
`
sql`
with xs as (
${ other }
)
select * from xs
` Now this should hopefully highlight that you can replace these with your own helper function(s) which should give you all the options you'd like. Now even though it does prevent sql injection of any kind, it doesn't mean you can't accidentally expose ways to access you database that was not intended, if you make any conditional query building available to users. I hope this gives enough info to go on :) |
Okay this is great. I'm going to explore more later today. One more thing. I was having trouble reverse engineering where in code this takes place. Could you point me to where a dynamic query is recognized and how it is parsed? |
Sure thing :) This recursive thing does the work Line 235 in ece705a
|
Awesome @porsager makes sense now. |
Here's what a few things needed for updated documentation: dynamic queries (!), With that I think we can simplify the structure of the README. There's a lot of stuff at the top that would serve better later in the document as being for advanced usage. I think there's an opportunity to make it easier for people get started with a simplified structure. I propose a structure like this:
What's your thoughts on something like this @porsager ? |
Wow! That looks like a great start @dilan-dio4 , and I think the order and grouping you've come up with looks very nice! Some notes:
I'll try to write the updated section for the connection pool description. |
* Cleaned up some language in README * README update * Moved sections to advanced query methods * cursor to async iterators * sql array removed parenthesis * #264 (comment) 2 and 3
I feel the docs are ready for release now. If anyone is up for it, I would love some feedback or just if you could read through them at https://github.com/porsager/postgres/tree/rewrite and check for any errors or missing details. |
Also just published an RC version to npm as well https://www.npmjs.com/package/postgres/v/3.0.0-rc.1 |
bytea literals like BTW, thank you very much for crafting this beautiful piece of software! 🙏 |
@s0xDk Hey, thanks a lot! Compared to v1? |
having, for example, hex-encoded binary data:
In v1 and v2.0.0-beta.11 I used:
In v3 that doesn't work. It's treating my already hex-encoded data as plain string
|
Sometimes the following error throws up:
But I don't use query timeouts, nor terminate any connections manually. |
Right, that's because v1 and v2 didn't know I unfortunately can't think of a nice way we can make both ways work. It's too lose to check if it's a string and if it starts with |
That is probably related to the new max lifetime, and the fact that a terminated connection is not removed immediately. Am I correct if this first comes after the service has run for 45 minutes? Would you mind trying the latest in #rewrite ? |
something like this, maybe? serialize: x => x.startsWith('\\x') ? x : '\\x' + Buffer.from(x).toString('hex') Or even more strict approach: serialize: x => x.match(/^\\x[0-9a-f]+$/i) ? x : '\\x' + Buffer.from(x).toString('hex') // or
serialize: x => x.match(/^\\x\p{Hex_Digit}+$/u) ? x : '\\x' + Buffer.from(x).toString('hex') |
Yes, it is. Sometimes it goes through that point without any issues, sometimes not. Will try the #latest, thank you! |
Yeah, that's what I think is too loose. There's a really good chance no one ever will be bitten by it, but I wouldn't want to be responsible for it if so.. |
Cool.. Let me know if it's good / bad. |
* fixed docs typos + minor cleanup * image alignment fix Co-authored-by: s13k <s13k@pm.me>
Something new happened:
|
@s0xDk Really nice feedback! There was indeed a race condition on connection end for transactions. It should be fixed now. |
# Conflicts: # README.md
Thanks for merging and publishing v3 on npm @porsager, congratulations!! 🎉 🎊 Thanks again for your tireless work on this project, really amazing!! 🙌 |
Thanks @karlhorky ! :) I hope it'll be put to good use ;) |
AMAZING!!! YOU PUBLISHED v3!!! Can't wait to try it! |
This is a complete rewrite to better support all the features that I was trying to get into v2. There are a few breaking changes from v2 beta , which some (myself included) are using in production, so I'm skipping a stable v2 release and going to v3.
Here are some of the new things available..
ParameterDescription
.describe()
to only get query input types and column definitionsBreaking changes from v2 -> v3
Result
arrays (previously cursor 1 would return a row object, where > 1 would return an array of rows).writable()
and.readable()
is now async (returns a Promise that resolves to the stream).execute()
is manually called..stream()
is renamed to.forEach
Result
class extendingArray
instead of an Array with extra properties (actually shouldn't be breaking unless you're doing something funny)Breaking changes from v1 -> v2 (v2 never moved on from beta)
sql()
in queries are now always quotedselect count(*)
becausecount()
returns a 64 bit integer (int8), so if you know yourcount()
won't be too big for a js number just cast in your query to int4 likeselect count(*)::int
Fixes #12, Fixes #30, Fixes #63, Fixes #65, Fixes #67, Fixes #89, Fixes #156, Fixes #159, Fixes #179, Fixes #201, Fixes #221, Fixes #230, Fixes #234, Fixes #248, Fixes #250, Fixes #252, Fixes #254
Closes #98, Closes #101, Closes #231, Closes #233