Initial curated chimera source from a8ae5b1db07fb49926c94585e2718e5130330974

test/server/read-only-sql.test.js

@@ -0,0 +1,27 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const { assertReadOnlySql, maskSql } = require('../../src/security/read-only-sql');
+
+test('read-only SQL policy accepts inspection queries and harmless literals', () => {
+  assert.equal(assertReadOnlySql('SELECT title FROM games LIMIT 10'), 'SELECT title FROM games LIMIT 10');
+  assert.equal(assertReadOnlySql("SELECT 'delete from games' AS example"), "SELECT 'delete from games' AS example");
+  assert.equal(assertReadOnlySql('WITH ids AS (SELECT id FROM games) SELECT * FROM ids'), 'WITH ids AS (SELECT id FROM games) SELECT * FROM ids');
+  assert.equal(assertReadOnlySql('PRAGMA table_info(games)'), 'PRAGMA table_info(games)');
+  assert.match(maskSql("SELECT 'quoted' -- comment\nFROM games"), /^SELECT\s+\s+\s+FROM games$/m);
+});
+
+test('read-only SQL policy blocks writable PRAGMAs, DML, stacked statements and extensions', () => {
+  const blocked = [
+    'PRAGMA user_version = 123',
+    'PRAGMA user_version(123)',
+    'PRAGMA journal_mode=WAL',
+    'PRAGMA optimize',
+    'WITH ids AS (SELECT id FROM games) DELETE FROM games',
+    'SELECT 1; DROP TABLE games',
+    "SELECT load_extension('payload')",
+    "SELECT writefile('/tmp/out', 'content')",
+  ];
+  for (const sql of blocked) assert.throws(() => assertReadOnlySql(sql), undefined, sql);
+});