Function injectOwnership

packages/core/src/scripts/db/exec.ts:297–352

* For INSERT statements targeting a table with owner_email / org_id columns, * auto-inject the current user's email and org ID if not already present. * * Handles the explicit column list form: * INSERT INTO table (col1, col2) VALUES (val1, val2)

(sql: string, scoping: ScopingContext)

 *   INSERT INTO table (col1, col2) VALUES (val1, val2)
 */
function injectOwnership(sql: string, scoping: ScopingContext): string {
  if (!scoping.active) return sql;

  const upper = sql
    .replace(/^\s*--[^\n]*\n/gm, "")
    .replace(/\/\*[\s\S]*?\*\//g, "")
    .trim()
    .toUpperCase();
  if (!upper.startsWith("INSERT")) return sql;

  // Extract table name: INSERT INTO <table> ...
  const match = sql.match(/INSERT\s+INTO\s+["']?(\w+)["']?/i);
  if (!match) return sql;

  const tableName = match[1];

  // Determine which columns to inject
  const injections: { col: string; value: string }[] = [];

  if (
    scoping.userEmail &&
    scoping.ownerEmailTables.has(tableName) &&
    !/owner_email/i.test(sql)
  ) {
    injections.push({
      col: "owner_email",
      value: `'${scoping.userEmail.replace(/'/g, "''")}'`,
    });
  }

  if (
    scoping.orgId &&
    scoping.orgIdTables.has(tableName) &&
    !/org_id/i.test(sql)
  ) {
    injections.push({
      col: "org_id",
      value: `'${scoping.orgId.replace(/'/g, "''")}'`,
    });
  }

  if (injections.length === 0) return sql;

  // Try to inject into explicit column list: INSERT INTO t (cols) VALUES (vals)
  const colListMatch = sql.match(
    /(INSERT\s+INTO\s+["']?\w+["']?\s*)\(([^)]+)\)(\s*VALUES\s*)\(([^)]+)\)/i,
  );
  if (colListMatch) {
    const [, prefix, cols, valueKeyword, vals] = colListMatch;
    const extraCols = injections.map((i) => i.col).join(", ");
    const extraVals = injections.map((i) => i.value).join(", ");
    return `${prefix}(${cols}, ${extraCols})${valueKeyword}(${vals}, ${extraVals})`;
  }

  return sql;
}

function escapeSqlString(value: string): string {