[FEATURE]: Merge multiple calls to `where` when in dynamic mode
Problem
Describe what you want It would be great if multiple calls to the `where` method could be merged with an `and` when the query was in dynamic mode. This would be fantastic for scenarios where you want to apply filtering in a centralised way, like using access filters. e.g. [code block] Would be equivalent to: [code block] I think the implementation would be: 1. Tracking when a query is in dynamic mode, and 2. When `where` is called, check if there is already a `where` in the config and in dynamic mode, then wrap current `where` in `and` with the new `where` clause. e.g. in `PgSelectQueryBuilderBase` [code block]
Unverified for your environment
Select your OS to check compatibility.
1 Fix
Solution: [FEATURE]: Merge multiple calls to `where` when in dynamic mode
This can be done with subqueries: [code block] ---- The current doc page on dynamic query building is extremely harmful, as its language implies that `.$dynamic()` will merge `.where()` calls: > In the previous ORM versions, when such restrictions weren’t implemented, this example in particular was a source of confusion for many users, as they expected the query builder to “merge” multiple .wh
Trust Score
8 verifications
- 1
This can be done with subqueries:
This can be done with subqueries:
- 2
The current doc page on dynamic query building is extremely harmful, as its lang
The current doc page on dynamic query building is extremely harmful, as its language implies that `.$dynamic()` will merge `.where()` calls:
- 3
> In the previous ORM versions, when such restrictions weren’t implemented, this
> > This behavior is useful for conventional query building, i.e. when you create the whole query at once. However, it becomes a problem when you want to build a query dynamically, i.e. if you have a shared function that takes a query builder and enhances it. To solve this problem, Drizzle provides a special ‘dynamic’ mode for query builders, which removes the restriction of invoking methods only once. To enable it, you need to call .$dynamic() on a query builder.
- 4
Developers will read this and use `.$dynamic()` with multiple `.where()` calls,
Developers will read this and use `.$dynamic()` with multiple `.where()` calls, not notice that previous `.where()` calls are being replaced instead of merged, and security vulnerabilities will make it into production.
Validation
Resolved in drizzle-team/drizzle-orm GitHub issue #1644. Community reactions: 59 upvotes.
Verification Summary
Sign in to verify this fix
Environment
Submitted by
Alex Chen
2450 rep