🛡️ Sentinel: [CRITICAL] Fix SQL Injection Risk in JSON Path Extraction

packages/core/src/db/database-wrapper.ts

@@ -105,15 +105,14 @@ export function jsonExtract(db: Database, column: SQL.Aliased | SQL | any, path:
   } else {
     // PostgreSQL: column->'path'->'to'->>'field'
     // Use -> for all but the last part (keeps as JSON), ->> for the last part (extracts as text)
-    // IMPORTANT: Use sql.raw() for JSON keys to avoid parameterization
     if (parts.length === 1) {
       // Single level: column->>'key'
-      return sql`${column}${sql.raw(`->>'${parts[0]}'`)}`;
+      return sql`${column} ->> (${parts[0]}::text)`;
     } else {
       // Multiple levels: column->'key1'->'key2'->>'key3'
-      const objectParts = parts.slice(0, -1).map((p) => sql.raw(`->'${p}'`));
+      const objectParts = parts.slice(0, -1).map((p) => sql`-> (${p}::text)`);
       const lastPart = parts[parts.length - 1];
-      return sql`${column}${sql.join(objectParts, sql``)}${sql.raw(`->>'${lastPart}'`)}`;
+      return sql`${column} ${sql.join(objectParts, sql` `)} ->> (${lastPart}::text)`;
     }
   }
 }

packages/core/src/db/repositories/sessions.test.ts

@@ -5,8 +5,8 @@
  * genealogy tracking, and JSON field handling.
  */
 
-import type { Session, UUID } from '@agor/core/types';
-import { SessionStatus } from '@agor/core/types';
+import type { Session, UUID } from '../../types';
+import { SessionStatus } from '../../types';
 import { describe, expect } from 'vitest';
 import { generateId } from '../../lib/ids';
 import { dbTest } from '../test-helpers';

packages/core/src/db/repositories/tasks.test.ts

@@ -4,8 +4,8 @@
  * Tests for type-safe CRUD operations on tasks with short ID support.
  */
 
-import type { Task, UUID } from '@agor/core/types';
-import { TaskStatus } from '@agor/core/types';
+import type { Task, UUID } from '../../types';
+import { TaskStatus } from '../../types';
 import { describe, expect } from 'vitest';
 import { generateId } from '../../lib/ids';
 import type { Database } from '../client';