Skip to content

Refactor DB queries to RPC #46

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
numbpill3d wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Refactor DB queries to RPC #46

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 12 additions & 6 deletions scripts/migrations/create-forum-tables.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,8 @@ async function createForumTables() {
// Table doesn't exist, create it
console.log('Creating forum_threads table...');

await supabaseAdmin.query(`
await supabaseAdmin.rpc('execute_sql', {
sql: `
CREATE TABLE forum_threads (
id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
title TEXT NOT NULL,
Expand All @@ -38,7 +39,8 @@ async function createForumTables() {
CREATE INDEX idx_forum_threads_creator_id ON forum_threads(creator_id);
CREATE INDEX idx_forum_threads_created_at ON forum_threads(created_at);
CREATE INDEX idx_forum_threads_updated_at ON forum_threads(updated_at);
`);
`
Copy link
Copy Markdown
Contributor

@codereviewbot-ai codereviewbot-ai bot Jun 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Security Concern: SQL Injection Risk

The use of raw SQL queries (execute_sql) with template literals can potentially expose the application to SQL injection attacks if not properly sanitized or parameterized. Although this script is likely run in a controlled migration environment, it's a good practice to avoid forming SQL commands directly from input variables or using parameterized queries or stored procedures to mitigate such risks.

Recommendation:
Consider using parameterized queries or stored procedures to enhance security, especially if any part of the SQL command can be influenced by external input in future modifications.

});

console.log('forum_threads table created successfully!');
} else {
Expand All @@ -55,7 +57,8 @@ async function createForumTables() {
// Table doesn't exist, create it
console.log('Creating forum_replies table...');

await supabaseAdmin.query(`
await supabaseAdmin.rpc('execute_sql', {
sql: `
CREATE TABLE forum_replies (
id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
thread_id UUID NOT NULL REFERENCES forum_threads(id) ON DELETE CASCADE,
Expand All @@ -69,7 +72,8 @@ async function createForumTables() {
CREATE INDEX idx_forum_replies_thread_id ON forum_replies(thread_id);
CREATE INDEX idx_forum_replies_creator_id ON forum_replies(creator_id);
CREATE INDEX idx_forum_replies_created_at ON forum_replies(created_at);
`);
`
});

console.log('forum_replies table created successfully!');
} else {
Expand All @@ -86,7 +90,8 @@ async function createForumTables() {
// Table doesn't exist, create it
console.log('Creating forum_categories table...');

await supabaseAdmin.query(`
await supabaseAdmin.rpc('execute_sql', {
sql: `
CREATE TABLE forum_categories (
id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
name TEXT NOT NULL UNIQUE,
Expand All @@ -99,7 +104,8 @@ async function createForumTables() {

-- Create index
CREATE INDEX idx_forum_categories_display_order ON forum_categories(display_order);
`);
`
});

// Insert default categories
await supabaseAdmin.from('forum_categories').insert([
Expand Down
6 changes: 4 additions & 2 deletions scripts/migrations/create-streetpass-table.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,8 @@ async function createStreetpassTable() {
// Table doesn't exist, create it
console.log('Creating streetpass_visits table...');

await supabaseAdmin.query(`
await supabaseAdmin.rpc('execute_sql', {
sql: `
CREATE TABLE streetpass_visits (
id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
visitor_id UUID NOT NULL REFERENCES users(id),
Expand All @@ -35,7 +36,8 @@ async function createStreetpassTable() {
CREATE INDEX idx_streetpass_visits_profile_id ON streetpass_visits(profile_id);
CREATE INDEX idx_streetpass_visits_visitor_id ON streetpass_visits(visitor_id);
CREATE INDEX idx_streetpass_visits_visited_at ON streetpass_visits(visited_at);
`);
`
});

console.log('streetpass_visits table created successfully!');
} else {
Expand Down
6 changes: 4 additions & 2 deletions scripts/migrations/create-wir-transactions-table.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,8 @@ async function createWIRTransactionsTable() {
// Table doesn't exist, create it
console.log('Creating market_wir_transactions table...');

await supabaseAdmin.query(`
await supabaseAdmin.rpc('execute_sql', {
sql: `
CREATE TABLE market_wir_transactions (
id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
Comment on lines +21 to 25
Copy link
Copy Markdown
Contributor

@codereviewbot-ai codereviewbot-ai bot Jun 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Potential SQL Injection and Dependency on uuid_generate_v4()

The SQL query for creating the table is embedded directly in the code and executed without explicit sanitization or parameterization, which could expose the system to SQL injection vulnerabilities. Additionally, the use of uuid_generate_v4() as a default value assumes that this function is available in the database, which might not be the case in all environments.

Recommendation:

  • Use parameterized queries or stored procedures to avoid SQL injection.
  • Ensure that uuid_generate_v4() is available in your database setup or provide an alternative method for generating UUIDs.

Expand Down Expand Up @@ -48,7 +49,8 @@ async function createWIRTransactionsTable() {
CREATE INDEX idx_wir_transactions_reference_id ON market_wir_transactions(reference_id);
CREATE INDEX idx_wir_transactions_created_at ON market_wir_transactions(created_at);
CREATE INDEX idx_wir_transactions_type ON market_wir_transactions(transaction_type);
`);
`
});

console.log('market_wir_transactions table created successfully!');
Copy link
Copy Markdown
Contributor

@codereviewbot-ai codereviewbot-ai bot Jun 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Lack of Verification After Table Creation

The script logs a success message after executing the table creation command but does not verify whether the table and indexes were actually created. This could lead to situations where the script reports success, but the operation failed due to underlying SQL errors or permission issues.

Recommendation:

  • Implement checks to verify the successful creation of the table and indexes. This could involve querying the database to confirm the existence of the table and indexes after the creation commands have been executed.

} else {
Expand Down
1 change: 1 addition & 0 deletions server/models/Item.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
module.exports = require('./ScrapyardItem');
18 changes: 12 additions & 6 deletions server/utils/database.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,7 +80,8 @@ async function initializeDatabase() {

if (error && error.code === '42P01') { // Table doesn't exist
console.log('Creating users table...');
await supabaseAdmin.query(`
await supabaseAdmin.rpc('execute_sql', {
sql: `
CREATE TABLE users (
id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
username TEXT UNIQUE NOT NULL,
Comment on lines 80 to 87
Copy link
Copy Markdown
Contributor

@codereviewbot-ai codereviewbot-ai bot Jun 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Potential Issue with UUID Generation

The SQL command for creating the users table assumes the availability of the uuid_generate_v4() function, which is provided by the uuid-ossp extension. This extension is created later in the script (lines 109-111). It's recommended to ensure that the extension is created before any table that requires it to prevent runtime errors during the table creation process.

Suggested Change:
Move the block of code that ensures the uuid-ossp extension exists to a point before any table creation that depends on it. This change would enhance the reliability of the database initialization process.

Expand Down Expand Up @@ -111,7 +112,8 @@ async function initializeDatabase() {
-- Create index on username and email
CREATE INDEX IF NOT EXISTS idx_users_username ON users(username);
CREATE INDEX IF NOT EXISTS idx_users_email ON users(email);
`);
`
});
}

// Create scrapyard_items table if not exists
Expand All @@ -122,7 +124,8 @@ async function initializeDatabase() {

if (itemsError && itemsError.code === '42P01') { // Table doesn't exist
console.log('Creating scrapyard_items table...');
await supabaseAdmin.query(`
await supabaseAdmin.rpc('execute_sql', {
sql: `
CREATE TABLE scrapyard_items (
id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
title TEXT NOT NULL,
Expand All @@ -146,7 +149,8 @@ async function initializeDatabase() {
-- Create indexes
CREATE INDEX IF NOT EXISTS idx_scrapyard_items_creator ON scrapyard_items(creator);
CREATE INDEX IF NOT EXISTS idx_scrapyard_items_category ON scrapyard_items(category);
`);
`
});
}

// Create sessions table if not exists
Expand All @@ -157,15 +161,17 @@ async function initializeDatabase() {

if (sessionsError && sessionsError.code === '42P01') { // Table doesn't exist
console.log('Creating sessions table...');
await supabaseAdmin.query(`
await supabaseAdmin.rpc('execute_sql', {
sql: `
CREATE TABLE sessions (
sid varchar NOT NULL PRIMARY KEY,
sess json NOT NULL,
expired timestamp(6) with time zone NOT NULL
);

CREATE INDEX IF NOT EXISTS idx_sessions_expired ON sessions(expired);
`);
`
});
}

console.log('Database initialization complete');
Comment on lines 161 to 177
Copy link
Copy Markdown
Contributor

@codereviewbot-ai codereviewbot-ai bot Jun 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Enhancement for Session Table Management

The creation of the sessions table includes an index on the expired field, which is excellent for performance when querying or cleaning up expired sessions. However, there is no automated mechanism shown here for handling the cleanup of expired sessions. Over time, without proper cleanup, the sessions table could grow significantly and impact performance.

Suggested Enhancement:
Implement a routine or scheduled task that periodically removes expired sessions from the sessions table. This could be done within this script or as a separate maintenance script, ensuring that the sessions table remains manageable and does not negatively impact database performance.

Expand Down