@@ -31,10 +31,12 @@ const safeContext: Context = {
3131 route : "/posts/:id" ,
3232} ;
3333
34+ const testOpts = { skip : ! global . Request ? "fetch is not available" : false } ;
35+
3436const agent = createTestAgent ( ) ;
3537agent . start ( [ new LibSQLClient ( ) ] ) ;
3638
37- t . test ( "it works with @libsql/client: in-memory" , async ( t ) => {
39+ t . test ( "it works with @libsql/client: in-memory" , testOpts , async ( t ) => {
3840 const { createClient } =
3941 require ( "@libsql/client" ) as typeof import ( "@libsql/client" ) ;
4042
@@ -166,6 +168,36 @@ t.test("it works with @libsql/client: in-memory", async (t) => {
166168 "Cannot read properties of null (reading 'map')"
167169 ) ;
168170 }
171+
172+ const transaction = await client . transaction ( "write" ) ;
173+
174+ const error9 = await t . rejects ( ( ) =>
175+ transaction . execute ( "SELECT 1;-- should be blocked" )
176+ ) ;
177+ t . ok ( error9 instanceof Error ) ;
178+ if ( error9 instanceof Error ) {
179+ t . same (
180+ error9 . message ,
181+ "Zen has blocked an SQL injection: @libsql/client.transaction.execute(...) originating from body.myTitle"
182+ ) ;
183+ }
184+
185+ const error10 = await t . rejects ( ( ) =>
186+ transaction . batch ( [ "SELECT 1;-- should be blocked" ] )
187+ ) ;
188+ t . ok ( error10 instanceof Error ) ;
189+ if ( error10 instanceof Error ) {
190+ t . same (
191+ error10 . message ,
192+ "Zen has blocked an SQL injection: @libsql/client.transaction.batch(...) originating from body.myTitle"
193+ ) ;
194+ }
195+
196+ await transaction . commit ( ) ;
197+ } ) ;
198+
199+ await runWithContext ( safeContext , async ( ) => {
200+ await client . execute ( "SELECT 1;-- This is a comment" ) ;
169201 } ) ;
170202 } catch ( error : any ) {
171203 t . fail ( error ) ;
@@ -174,7 +206,7 @@ t.test("it works with @libsql/client: in-memory", async (t) => {
174206 }
175207} ) ;
176208
177- t . test ( "it works with @libsql/client: http" , async ( t ) => {
209+ t . test ( "it works with @libsql/client: http" , testOpts , async ( t ) => {
178210 const { createClient } =
179211 require ( "@libsql/client" ) as typeof import ( "@libsql/client" ) ;
180212
@@ -270,6 +302,32 @@ t.test("it works with @libsql/client: http", async (t) => {
270302 "Zen has blocked an SQL injection: @libsql/client.batch(...) originating from body.myTitle"
271303 ) ;
272304 }
305+
306+ const transaction = await client . transaction ( "write" ) ;
307+
308+ const error9 = await t . rejects ( ( ) =>
309+ transaction . execute ( "SELECT 1;-- should be blocked" )
310+ ) ;
311+ t . ok ( error9 instanceof Error ) ;
312+ if ( error9 instanceof Error ) {
313+ t . same (
314+ error9 . message ,
315+ "Zen has blocked an SQL injection: @libsql/client.transaction.execute(...) originating from body.myTitle"
316+ ) ;
317+ }
318+
319+ const error10 = await t . rejects ( ( ) =>
320+ transaction . batch ( [ "SELECT 1;-- should be blocked" ] )
321+ ) ;
322+ t . ok ( error10 instanceof Error ) ;
323+ if ( error10 instanceof Error ) {
324+ t . same (
325+ error10 . message ,
326+ "Zen has blocked an SQL injection: @libsql/client.transaction.batch(...) originating from body.myTitle"
327+ ) ;
328+ }
329+
330+ await transaction . commit ( ) ;
273331 } ) ;
274332 } catch ( error : any ) {
275333 t . fail ( error ) ;
0 commit comments