rogerpadilla / uql / 30306870180

97%

push

github

fix(orm): security filters on populated relations, JSON placeholder bugs, dialect cleanup

- security: true filters were skipped by a bare $populate with no explicit
  $where, on every driver including MongoDB's $lookup - now enforced
  unconditionally, matching the guarantee already documented for top-level
  queries.
- PostgreSQL/CockroachDB: $size misbound its value when it wasn't the first
  bound condition in $where (placeholder numbering bug in an isolated
  fragment context).
- PostgreSQL/CockroachDB: upsertOne/upsertMany bound the wrong value to the
  2nd+ auto-filled onUpdate column omitted from the payload (same root
  cause). Fixed both by sharing the real context's values array with the
  fragment context instead of reconciling placeholders after the fact.
- SQLite/MySQL/MariaDB: a nested $elemMatch on an array-of-arrays field
  could return zero rows instead of the matching ones - $elemMatch's
  derived-table alias was one fixed literal reused at every nesting depth.
  Each nesting level now gets a unique alias via a new QueryContext.nextAlias.
- Removed the securityFilter() sugar helper (kept the security: true
  mechanism itself); deduplicated ~450 lines of near-identical dialect and
  test-spec code across MySQL/MariaDB/PostgreSQL/SQLite; removed several
  dead code paths in the SQL dialect layer.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

3391 of 3743 branches covered (90.6%)

Branch coverage included in aggregate %.

70 of 70 new or added lines in 10 files covered. (100.0%)

5754 of 5878 relevant lines covered (97.89%)

729.69 hits per line