[merge]

bin/sequelize

@@ -229,27 +229,31 @@ if (program.migrate || program.undo) {
       migratorOptions = _.merge(migratorOptions, { filesFilter: /\.js$|\.coffee$/ })
     }
 
-    var migrator = sequelize.getMigrator(migratorOptions)
-
-    if (program.undo) {
-      migrator.findOrCreateSequelizeMetaDAO().success(function(Meta) {
-        Meta.find({ order: 'id DESC' }).success(function(meta) {
-          if (meta) {
-            migrator = sequelize.getMigrator(_.extend(migratorOptions, meta.values), true)
-            migrator.migrate({ method: 'down' }).success(function() {
+    sequelize.authenticate().success(function () {
+      var migrator = sequelize.getMigrator(migratorOptions)
+
+      if (program.undo) {
+        migrator.findOrCreateSequelizeMetaDAO().success(function(Meta) {
+          Meta.find({ order: 'id DESC' }).success(function(meta) {
+            if (meta) {
+              migrator = sequelize.getMigrator(_.extend(migratorOptions, meta.values), true)
+              migrator.migrate({ method: 'down' }).success(function() {
+                process.exit(0)
+              })
+            } else {
+              console.log("There are no pending migrations.")
               process.exit(0)
-            })
-          } else {
-            console.log("There are no pending migrations.")
-            process.exit(0)
-          }
+            }
+          })
         })
-      })
-    } else {
-      sequelize.migrate().success(function() {
-        process.exit(0)
-      })
-    }
+      } else {
+        sequelize.migrate().success(function() {
+          process.exit(0)
+        })
+      }
+    }).error(function (err) {
+      console.error("Unable to connect to database: "+err)
+    })
   } else {
     console.log('Cannot find "' + configuration.configFile + '". Have you run "sequelize --init"?')
     process.exit(1)

changelog.md

 Notice: All 1.7.x changes are present in 2.0.x aswell
 
+# v1.7.0-rc7 (next)
+- [BUG] ORDER BY statements when using includes should now be places in the appropriate sub/main query more intelligently.
+- [BUG] using include.attributes with primary key attributes specified should no longer result in multiple primary key attributes being selected [#1410](https://github.com/sequelize/sequelize/pull/1410)
+- [DEPENDENCIES] all dependencies, including Validator have been updated to the latest versions.
+
+#### Backwards compatability changes
+- .set() will no longer set values that are not a dynamic setter or defined in the model. This only breaks BC since .set() was introduced but restores original .updateAttributes functionality where it was possible to 'trust' user input.
+
 # v1.7.0-rc6
 - [BUG] Encode binary strings as bytea in postgres, and fix a case where using a binary as key in an association would produce an error [1364](https://github.com/sequelize/sequelize/pull/1364). Thanks to @SohumB
 

lib/dao-factory.js

@@ -613,7 +613,7 @@ module.exports = (function() {
   DAOFactory.prototype.findAndCountAll = function(findOptions, queryOptions) {
     var self  = this
       // no limit, offset, order, attributes for the options given to count()
-      , countOptions = Utils._.omit(findOptions || {}, ['offset', 'limit', 'order', 'attributes'])
+      , countOptions = Utils._.omit(findOptions ? Utils._.merge({}, findOptions) : {}, ['offset', 'limit', 'order', 'attributes'])
 
     return new Utils.CustomEventEmitter(function (emitter) {
       var emit = {

lib/dao.js

@@ -157,6 +157,11 @@ module.exports = (function() {
           this._setInclude(key, value, options)
           return
         } else {
+          // If not raw, and attribute is not in model definition
+          if (!options.raw && Object.keys(this.Model.attributes).indexOf(key) === -1) {
+            return;
+          }
+
           // If attempting to set primary key and primary key is already defined, return
           if (this.Model._hasPrimaryKeys && originalValue && this.Model._isPrimaryKey(key)) {
             return
@@ -262,7 +267,7 @@ module.exports = (function() {
     options = Utils._.extend({}, options, fieldsOrOptions)
 
     if (!options.fields) {
-      options.fields = this.attributes
+      options.fields = Object.keys(this.Model.attributes)
     }
 
     if (options.returning === undefined) {

lib/dialects/abstract/query-generator.js

@@ -536,7 +536,15 @@ module.exports = (function() {
       }.bind(this)).join(", ")
 
       if (subQuery && mainAttributes) {
-        mainAttributes = mainAttributes.concat(Model.primaryKeyAttributes)
+        if (Model.hasPrimaryKeys) {
+          Model.primaryKeyAttributes.forEach(function(keyAtt){
+            if(mainAttributes.indexOf(keyAtt) == -1){
+              mainAttributes.push(keyAtt)
+            }
+          })
+        } else {
+          mainAttributes.push("id")
+        }          
       }
 
       // Escape attributes
@@ -767,12 +775,25 @@ module.exports = (function() {
 
       // Add ORDER to sub or main query
       if (options.order) {
-        options.order = Array.isArray(options.order) ? options.order.map(function (t) { return this.quote(t, Model) }.bind(this)).join(', ') : options.order
+        var mainQueryOrder = [];
+        var subQueryOrder = [];
 
-        if (subQuery) {
-          subQueryItems.push(" ORDER BY " + options.order)
+        if (Array.isArray(options.order)) {
+          options.order.forEach(function (t) {
+            if (subQuery && !(t[0] instanceof daoFactory)) {
+              subQueryOrder.push(this.quote(t, Model))
+            }
+            mainQueryOrder.push(this.quote(t, Model))
+          }.bind(this))
         } else {
-          mainQueryItems.push(" ORDER BY " + options.order)
+          mainQueryOrder.push(options.order)
+        }
+        
+        if (mainQueryOrder.length) {
+          mainQueryItems.push(" ORDER BY " + mainQueryOrder.join(', '))
+        }
+        if (subQueryOrder.length) {
+          subQueryItems.push(" ORDER BY " + subQueryOrder.join(', '))
         }
       }
 
@@ -793,6 +814,7 @@ module.exports = (function() {
           query += subQueryItems.join('')
         query += ") AS "+options.table
         query += mainJoinQueries.join('')
+        query += mainQueryItems.join('')
       } else {
         query = mainQueryItems.join('')
       }
@@ -908,7 +930,7 @@ module.exports = (function() {
           if (treatAsAnd) {
             return treatAsAnd
           } else {
-            return !(arg instanceof Date) && ((arg instanceof Utils.and) || (arg instanceof Utils.or) || Utils.isHash(arg) || Array.isArray(arg))
+            return !(arg instanceof Date) && ((arg instanceof Utils.and) || (arg instanceof Utils.or) || Utils.isHash(arg))
           }
         }, false)
 

lib/sequelize.js

@@ -60,8 +60,8 @@ module.exports = (function() {
       urlParts = url.parse(arguments[0])
 
       // SQLite don't have DB in connection url
-      if (urlParts.path) {
-        database = urlParts.path.replace(/^\//,  '')
+      if (urlParts.pathname) {
+        database = urlParts.pathname.replace(/^\//,  '')
       }
 
       dialect = urlParts.protocol
@@ -140,6 +140,8 @@ module.exports = (function() {
 
   Sequelize.DAOValidator = DAOValidator
 
+  Sequelize.DAOFactory = Sequelize.Model = DAOFactory
+
   for (var dataType in DataTypes) {
     Sequelize[dataType] = DataTypes[dataType]
   }

package.json

@@ -46,7 +46,7 @@
     "lingo": "~0.0.5",
     "validator": "~3.2.0",
     "moment": "~2.5.0",
-    "dottie": "0.0.9-0",
+    "dottie": "0.1.0",
     "toposort-class": "~0.3.0",
     "generic-pool": "2.0.4",
     "sql": "~0.35.0",

test/dao-factory/and-or-where.test.js

@@ -119,6 +119,17 @@ describe(Support.getTestDialectTeaser("DAOFactory"), function () {
       })
     })
 
+    if (dialect !== 'postgres') {
+      it('still allows simple arrays lookups', function (done) {
+        this.User.find({
+          where: ["id IN (?) OR id IN (?)", [1, 2], [3, 4]]
+        }).on('sql', function(sql) {
+          expect(sql).to.contain("id IN (1, 2) OR id IN (3, 4)")
+          done()
+        })
+      })
+    }
+
     ;(['find', 'findAll']).forEach(function(finderMethod) {
       it('correctly handles complex combinations', function(done) {
         this.User[finderMethod]({

test/dao-factory/findAll.test.js

@@ -1029,6 +1029,28 @@ describe(Support.getTestDialectTeaser("DAOFactory"), function () {
           }, function() {done()})
         })
 
+        it('sorts by 1st degree association while using limit', function(done) {
+          var self = this
+          async.forEach([ [ 'ASC', 'England', 'Energy' ], [ 'DESC', 'Korea', 'Tech' ] ], function(params, callback) {
+            self.Country.findAll({
+              include: [ self.Industry ],
+              order: [
+                [ self.Industry, 'name', params[0] ] 
+              ],
+              limit: 3
+            }).done(function(err, countries) {
+              expect(err).not.to.be.ok
+              expect(countries).to.exist
+              expect(countries[0]).to.exist
+              expect(countries[0].name).to.equal(params[1])
+              expect(countries[0].industries).to.exist
+              expect(countries[0].industries[0]).to.exist
+              expect(countries[0].industries[0].name).to.equal(params[2])
+              callback()
+            })
+          }, function() {done()})
+        })
+
         it('sorts by through table attribute', function(done) {
           var self = this
           async.forEach([ [ 'ASC', 'England', 'Energy' ], [ 'DESC', 'France', 'Media' ] ], function(params, callback) {

test/dao/values.test.js

@@ -62,6 +62,34 @@ describe(Support.getTestDialectTeaser("DAO"), function () {
         expect(user.get('updatedAt')).not.to.be.ok
       })
 
+      it('doesn\'t set value if not a dynamic setter or a model attribute', function() {
+        var User = this.sequelize.define('User', {
+          name: {type: DataTypes.STRING},
+          email_hidden: {type: DataTypes.STRING}
+        }, {
+          setterMethods: {
+            email_secret: function (value) {
+              this.set('email_hidden', value)
+            }
+          }
+        })
+
+        var user = User.build()
+
+        user.set({
+          name: 'antonio banderaz',
+          email: 'antonio@banderaz.com',
+          email_secret: 'foo@bar.com'
+        })
+
+        user.set('email', 'antonio@banderaz.com')
+
+        expect(user.get('name')).to.equal('antonio banderaz')
+        expect(user.get('email_hidden')).to.equal('foo@bar.com')
+        expect(user.get('email')).not.to.be.ok
+        expect(user.dataValues.email).not.to.be.ok
+      })
+
       describe('includes', function () {
         it('should support basic includes', function () {
           var Product = this.sequelize.define('Product', {

test/include.test.js

@@ -22,6 +22,42 @@ var sortById = function(a, b) {
 
 describe(Support.getTestDialectTeaser("Include"), function () {
   describe('find', function () {
+    it('should support a empty belongsTo include', function (done) {
+      var Company = this.sequelize.define('Company', {})
+        , User = this.sequelize.define('User', {})
+
+      User.belongsTo(Company, {as: 'Employer'})
+      this.sequelize.sync({force: true}).done(function () {
+        User.create().then(function () {
+          User.find({
+            include: [{model: Company, as: 'Employer'}]
+          }).done(function (err, user) {
+            expect(err).not.to.be.ok
+            expect(user).to.be.ok
+            done()
+          })
+        }, done)
+      })
+    })
+
+    it('should support a empty hasOne include', function (done) {
+      var Company = this.sequelize.define('Company', {})
+        , Person = this.sequelize.define('Person', {})
+
+      Company.hasOne(Person, {as: 'CEO'})
+      this.sequelize.sync({force: true}).done(function () {
+        Company.create().then(function () {
+          Company.find({
+            include: [{model: Person, as: 'CEO'}]
+          }).done(function (err, company) {
+            expect(err).not.to.be.ok
+            expect(company).to.be.ok
+            done()
+          })
+        }, done)
+      })
+    })
+
     it('should support a simple nested belongsTo -> belongsTo include', function (done) {
       var Task = this.sequelize.define('Task', {})
         , User = this.sequelize.define('User', {})

test/sequelize.test.js

@@ -48,6 +48,9 @@ describe(Support.getTestDialectTeaser("Sequelize"), function () {
       it('should work with connection strings (2)', function () {
         var sequelize = new Sequelize('sqlite://test.sqlite/')
       })
+      it('should work with connection strings (3)', function () {
+        var sequelize = new Sequelize('sqlite://test.sqlite/lol?reconnect=true')
+      })
     }
   })