do not mutate escape when needed

Author: Sylvestre Gug

src/table.mjs

@@ -246,17 +246,13 @@ export function makeQueryTemplate(operations, source) {
   const args = [
     [`SELECT ${columns} FROM ${formatTable(from.table, escaper)} t`]
   ];
+  args.escaper = escaper;
   for (let i = 0; i < filter.length; ++i) {
     appendSql(i ? `\nAND ` : `\nWHERE `, args);
-    if (!filter[i].operands) throw new Error("missing operands");
-    filter[i].operands.forEach((op) => {
-      if (op.type === "column") op.value = escaper(op.value);
-    });
     appendWhereEntry(filter[i], args);
   }
   for (let i = 0; i < sort.length; ++i) {
     appendSql(i ? `, ` : `\nORDER BY `, args);
-    sort[i].column = escaper(sort[i].column);
     appendOrderBy(sort[i], args);
   }
   if (source.dialect === "mssql") {
@@ -268,7 +264,7 @@ export function makeQueryTemplate(operations, source) {
           );
         appendSql(`\nORDER BY `, args);
         appendOrderBy(
-          {column: escaper(select.columns[0]), direction: "ASC"},
+          {column: select.columns[0], direction: "ASC"},
           args
         );
       }
@@ -291,6 +287,7 @@ export function makeQueryTemplate(operations, source) {
       appendSql(` OFFSET ${slice.from}`, args);
     }
   }
+  delete args.escaper;
   return args;
 }
 
@@ -311,7 +308,8 @@ function appendSql(sql, args) {
 }
 
 function appendOrderBy({column, direction}, args) {
-  appendSql(`t.${column} ${direction.toUpperCase()}`, args);
+  const escaper = args.escaper;
+  appendSql(`t.${escaper(column)} ${direction.toUpperCase()}`, args);
 }
 
 function appendWhereEntry({type, operands}, args) {
@@ -396,7 +394,8 @@ function appendWhereEntry({type, operands}, args) {
 
 function appendOperand(o, args) {
   if (o.type === "column") {
-    appendSql(`t.${o.value}`, args);
+    const escaper = args.escaper;
+    appendSql(`t.${escaper(o.value)}`, args);
   } else {
     args.push(o.value);
     args[0].push("");

test/table-test.mjs

@@ -129,42 +129,43 @@ describe("makeQueryTemplate", () => {
     assert.deepStrictEqual(params, ["val1"]);
   });
 
-  it("makeQueryTemplate filter list", () => {
-    const source = {name: "db", dialect: "postgres"};
+  it("makeQueryTemplate filter and escape filters column only once", () => {
+    const source = {name: "db", dialect: "postgres", escape: (i) => `_${i}_`};
     const operations = {
       ...baseOperations,
       filter: [
         {
-          type: "in",
-          operands: [
-            {type: "column", value: "col1"},
-            {type: "resolved", value: "val1"},
-            {type: "resolved", value: "val2"},
-            {type: "resolved", value: "val3"}
-          ]
-        },
-        {
-          type: "nin",
+          type: "eq",
           operands: [
-            {type: "column", value: "col1"},
-            {type: "resolved", value: "val4"}
+            {type: "column", value: "col2"},
+            {type: "resolved", value: "val1"}
           ]
         }
       ]
     };
 
+    makeQueryTemplate(operations, source);
     const [parts, ...params] = makeQueryTemplate(operations, source);
-    assert.deepStrictEqual(parts.join("?"), "SELECT t.col1,t.col2 FROM table1 t\nWHERE t.col1 IN (?,?,?)\nAND t.col1 NOT IN (?)");
-    assert.deepStrictEqual(params, ["val1", "val2", "val3", "val4"]);
+    assert.deepStrictEqual(
+        parts.join("?"),
+        "SELECT t._col1_,t._col2_ FROM table1 t\nWHERE t._col2_ = ?"
+    );
+    assert.deepStrictEqual(params, ["val1"]);
   });
 
-  it("makeQueryTemplate throw if filter is missing operands", () => {
+  it("makeQueryTemplate filter list", () => {
     const source = {name: "db", dialect: "postgres"};
     const operations = {
       ...baseOperations,
       filter: [
         {
-          type: "in"
+          type: "in",
+          operands: [
+            {type: "column", value: "col1"},
+            {type: "resolved", value: "val1"},
+            {type: "resolved", value: "val2"},
+            {type: "resolved", value: "val3"}
+          ]
         },
         {
           type: "nin",
@@ -176,9 +177,9 @@ describe("makeQueryTemplate", () => {
       ]
     };
 
-    assert.throws(() => {
-      makeQueryTemplate(operations, source);
-    }, Error);
+    const [parts, ...params] = makeQueryTemplate(operations, source);
+    assert.deepStrictEqual(parts.join("?"), "SELECT t.col1,t.col2 FROM table1 t\nWHERE t.col1 IN (?,?,?)\nAND t.col1 NOT IN (?)");
+    assert.deepStrictEqual(params, ["val1", "val2", "val3", "val4"]);
   });
 
   it("makeQueryTemplate select", () => {