| 50 | } |
| 51 | |
| 52 | function normalizeSql(sql: unknown, maxRows: number): string { |
| 53 | if (typeof sql !== 'string' || sql.trim().length === 0) { |
| 54 | throw new Error('sql must be a non-empty string') |
| 55 | } |
| 56 | |
| 57 | const trimmed = sql.trim().replace(/;+\s*$/, '') |
| 58 | if (trimmed.includes(';')) { |
| 59 | throw new Error('Only a single read-only SQL statement is allowed') |
| 60 | } |
| 61 | |
| 62 | const statementStart = trimmed.replace(/^(\s|--[^\n]*(\n|$)|\/\*[\s\S]*?\*\/)*/, '') |
| 63 | if (!/^(SELECT|WITH)\b/i.test(statementStart)) { |
| 64 | throw new Error('render_chart only accepts SELECT or WITH SELECT SQL') |
| 65 | } |
| 66 | |
| 67 | if (RE_SECONDS_TIMESTAMP_DIVIDED_AS_MILLISECONDS.test(trimmed)) { |
| 68 | throw new Error('message.ts is already a Unix timestamp in seconds; do not divide ts by 1000') |
| 69 | } |
| 70 | |
| 71 | return `SELECT * FROM (\n${trimmed}\n) AS chart_query LIMIT ${maxRows + 1}` |
| 72 | } |
| 73 | |
| 74 | function normalizeParams(raw: unknown): Record<string, unknown> { |
| 75 | if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return {} |