rogerpadilla / uql / 29164059729

97%

push

github

fix(dialect): validate operator/sort/aggregate keys via typed allowlists

Query-provided operator keys ($where/$having comparisons, $sort directions,
$group aggregates, vector distance metrics) were looked up in plain
objects/records, so an unrecognized key could resolve via the prototype
chain or, for $group, get spliced straight into generated SQL. These now
go through Map-based allowlists whose key types tie back to the canonical
operator unions, so a drift is caught at compile time and an unsupported
value throws instead of silently doing the wrong thing. Also closes a gap
where MariaDB's inline vector index silently built with the wrong distance
metric instead of erroring, matching the fix already applied to CockroachDB.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

3282 of 3630 branches covered (90.41%)

Branch coverage included in aggregate %.

89 of 91 new or added lines in 11 files covered. (97.8%)

5677 of 5803 relevant lines covered (97.83%)

460.27 hits per line