Refactor quoting of identifiers and strings, with optional non-quoting of

identifiers in Postgres

lib/dao-factory.js

@@ -213,7 +213,7 @@ module.exports = (function() {
   //right now, the caller (has-many-double-linked) is in charge of the where clause
   DAOFactory.prototype.findAllJoin = function(joinTableName, options) {
     var optcpy = Utils._.clone(options)
-    optcpy.attributes = optcpy.attributes || [Utils.addTicks(this.tableName)+".*"]
+    optcpy.attributes = optcpy.attributes || [this.QueryInterface.quoteIdentifier(this.tableName)+".*"]
 
     // whereCollection is used for non-primary key updates
     this.options.whereCollection = optcpy.where || null;

lib/dao.js

@@ -136,7 +136,7 @@ module.exports = (function() {
                 throw new Error('Value for HSTORE must be a string or number.')
               }
 
-              text.push(this.QueryInterface.QueryGenerator.addQuotes(key) + '=>' + (typeof value === "string" ? this.QueryInterface.QueryGenerator.addQuotes(value) : value))
+              text.push(this.QueryInterface.quoteIdentifier(key) + '=>' + (typeof value === "string" ? this.QueryInterface.quoteIdentifier(value) : value))
             }.bind(this))
             values[attrName] = text.join(',')
           }
@@ -180,7 +180,7 @@ module.exports = (function() {
   */
   DAO.prototype.reload = function() {
     var where = [
-      this.QueryInterface.QueryGenerator.addQuotes(this.__factory.tableName) + '.' + this.QueryInterface.QueryGenerator.addQuotes('id')+'=?',
+      this.QueryInterface.quoteIdentifier(this.__factory.tableName) + '.' + this.QueryInterface.quoteIdentifier('id')+'=?',
       this.id
     ]
 

lib/dialects/postgres/query.js

@@ -108,6 +108,20 @@ module.exports = (function() {
 
         this.emit('success', result)
       } else {
+        // Postgres will treat tables as case-insensitive, so fix the case
+        // of the returned values to match attributes
+        if(this.sequelize.options.quoteIdentifiers == false) {
+          var attrsMap = Utils._.reduce(this.callee.attributes, function(m, v, k) { m[k.toLowerCase()] = k; return m}, {})
+          rows.forEach(function(row) {
+            Utils._.keys(row).forEach(function(key) {
+              var targetAttr = attrsMap[key]
+              if(targetAttr != key) {
+                row[targetAttr] = row[key]
+                delete row[key]
+              }
+            })
+          })
+        }
         this.emit('success', this.send('handleSelectQuery', rows))
       }
     } else if (this.send('isShowOrDescribeQuery')) {

lib/dialects/query-generator.js

@@ -269,6 +269,27 @@ module.exports = (function() {
     */
     disableForeignKeyConstraintsQuery: function() {
        throwMethodUndefined('disableForeignKeyConstraintsQuery')
+    },
+
+    /*
+      Escape an identifier (e.g. a table or attribute name)
+    */
+    quoteIdentifier: function(identifier, force) {
+      throwMethodUndefined('quoteIdentifier')
+    },
+
+    /*
+      Split an identifier into .-separated tokens and quote each part
+    */
+    quoteIdentifiers: function(identifiers, force) {
+      throwMethodUndefined('quoteIdentifiers')
+    },
+
+    /*
+      Escape a value (e.g. a string, number or date)
+    */
+    escape: function(value) {
+      throwMethodUndefined('quoteIdentifier')
     }
 
   }

lib/query-interface.js

@@ -358,6 +358,33 @@ module.exports = (function() {
     }
   }
 
+  // Helper methods useful for querying
+
+  /**
+   * Escape an identifier (e.g. a table or attribute name). If force is true,
+   * the identifier will be quoted even if the `quoteIdentifiers` option is
+   * false.
+   */
+  QueryInterface.prototype.quoteIdentifier = function(identifier, force) {
+    return this.QueryGenerator.quoteIdentifier(identifier, force)
+  }
+
+  /**
+   * Split an identifier into .-separated tokens and quote each part.
+   * If force is true, the identifier will be quoted even if the
+   * `quoteIdentifiers` option is false.
+   */
+  QueryInterface.prototype.quoteIdentifiers = function(identifiers, force) {
+    return this.QueryGenerator.quoteIdentifiers(identifiers, force)
+  }
+
+  /**
+   * Escape a value (e.g. a string, number or date)
+   */
+  QueryInterface.prototype.escape = function(value) {
+    return this.QueryGenerator.escape(value)
+  }
+
   // private
 
   var queryAndEmit = function(sqlOrQueryParams, methodName, options, emitter) {

lib/sequelize.js

@@ -26,6 +26,7 @@ module.exports = (function() {
       @param {Boolean} [options.native=false] A flag that defines if native library shall be used or not.
       @param {Boolean} [options.replication=false] I have absolutely no idea.
       @param {Object} [options.pool={}] Something.
+      @param {Boolean} [options.quoteIdentifiers=true] Set to `false` to make table names and attributes case-insensitive on Postgres and skip double quoting of them.
 
     @example
         // without password and options
@@ -78,7 +79,8 @@ module.exports = (function() {
       queue: true,
       native: false,
       replication: false,
-      pool: {}
+      pool: {},
+      quoteIdentifiers: true
     }, options || {})
 
     if (this.options.logging === true) {

lib/utils.js

@@ -35,18 +35,6 @@ var Utils = module.exports = {
   addEventEmitter: function(_class) {
     util.inherits(_class, require('events').EventEmitter)
   },
-  TICK_CHAR: '`',
-  addTicks: function(s, tickChar) {
-    tickChar = tickChar || Utils.TICK_CHAR
-    return tickChar + Utils.removeTicks(s, tickChar) + tickChar
-  },
-  removeTicks: function(s, tickChar) {
-    tickChar = tickChar || Utils.TICK_CHAR
-    return s.replace(new RegExp(tickChar, 'g'), "")
-  },
-  escape: function(s) {
-    return SqlString.escape(s, true, "local").replace(/\\"/g, '"')
-  },
   format: function(arr, dialect) {
     var timeZone = null;
     return SqlString.format(arr.shift(), arr, timeZone, dialect)
@@ -180,6 +168,22 @@ var Utils = module.exports = {
     var now = new Date()
     now.setMilliseconds(0)
     return now
+  },
+
+  // Note: Use the `quoteIdentifier()` and `escape()` methods on the
+  // `QueryInterface` instead for more portable code.
+
+  TICK_CHAR: '`',
+  addTicks: function(s, tickChar) {
+    tickChar = tickChar || Utils.TICK_CHAR
+    return tickChar + Utils.removeTicks(s, tickChar) + tickChar
+  },
+  removeTicks: function(s, tickChar) {
+    tickChar = tickChar || Utils.TICK_CHAR
+    return s.replace(new RegExp(tickChar, 'g'), "")
+  },
+  escape: function(s) {
+    return SqlString.escape(s, true, "local").replace(/\\"/g, '"')
   }
 }
 

spec-jasmine/mysql/query-generator.spec.js

@@ -398,7 +398,8 @@ describe('QueryGenerator', function() {
         it(title, function() {
           // Options would normally be set by the query interface that instantiates the query-generator, but here we specify it explicitly
           var context = test.context || {options: {}};
-          var conditions = QueryGenerator[suiteTitle].apply(context, test.arguments)
+          QueryGenerator.options = context.options
+          var conditions = QueryGenerator[suiteTitle].apply(QueryGenerator, test.arguments)
 
           expect(conditions).toEqual(test.expectation)
         })

spec-jasmine/sqlite/query-generator.spec.js

@@ -206,7 +206,7 @@ describe('QueryGenerator', function() {
         expectation: "DELETE FROM `myTable` WHERE `id`=1"
       }, {
         arguments: ['myTable', {name: "foo';DROP TABLE myTable;"}, {limit: 10}],
-        expectation: "DELETE FROM `myTable` WHERE `name`='foo\\';DROP TABLE myTable;'"
+        expectation: "DELETE FROM `myTable` WHERE `name`='foo'';DROP TABLE myTable;'"
       }, {
         arguments: ['myTable', {name: 'foo'}, {limit: null}],
         expectation: "DELETE FROM `myTable` WHERE `name`='foo'"
@@ -221,8 +221,8 @@ describe('QueryGenerator', function() {
         it(title, function() {
           // Options would normally be set by the query interface that instantiates the query-generator, but here we specify it explicitly
           var context = test.context || {options: {}};
-          
-          var conditions = QueryGenerator[suiteTitle].apply(context, test.arguments)
+          QueryGenerator.options = context.options
+          var conditions = QueryGenerator[suiteTitle].apply(QueryGenerator, test.arguments)
           expect(conditions).toEqual(test.expectation)
         })
       })

spec/associations/has-many.spec.js

@@ -9,6 +9,7 @@ buster.spec.expose()
 buster.testRunner.timeout = 500
 
 describe(Helpers.getTestDialectTeaser("HasMany"), function() {
+
   before(function(done) {
     var self = this
 

spec/postgres/dao.spec.js

@@ -65,4 +65,60 @@ if (dialect.match(/^postgres/)) {
       })
     })
   })
+
+  describe('[POSTGRES] Unquoted identifiers', function() {
+
+    before(function(done) {
+      var self = this
+
+      Helpers.initTests({
+        dialect: dialect,
+        beforeComplete: function(sequelize, DataTypes) {
+          self.sequelize = sequelize
+          self.sequelize.options.quoteIdentifiers = false
+
+          self.User = sequelize.define('User', {
+            username: DataTypes.STRING,
+            fullName: DataTypes.STRING // Note mixed case
+          })
+        },
+        onComplete: function() {
+          // We can create a table with non-quoted identifiers
+          self.User.sync({ force: true }).success(done)
+        }
+      })
+    })
+
+    it("can insert and select", function(done) {
+      var self = this
+
+      self.User
+        .create({ username: 'user', fullName: "John Smith" })
+        .success(function(user) {
+          // We can insert into a table with non-quoted identifiers
+          expect(user.id).toBeDefined()
+          expect(user.id).not.toBeNull()
+          expect(user.username).toEqual('user')
+          expect(user.fullName).toEqual('John Smith')
+
+          // We can query by non-quoted identifiers
+          self.User.find({
+            where: {fullName: "John Smith"}
+          })
+          .success(function(user2) {
+            // We can map values back to non-quoted identifiers
+            expect(user2.id).toEqual(user.id)
+            expect(user2.username).toEqual('user')
+            expect(user2.fullName).toEqual('John Smith')
+            done();
+          })
+          .error(function(err) {
+            console.log(err)
+          })
+        })
+        .error(function(err) {
+          console.log(err)
+        })
+    })
+  })
 }