Feat/um 154 add event data rewrite queries (#1739)

* Cherry pick prisma query protection.

* Re-write CH queries to use query params.

* Fix query.

* Fix modal.  Re-add form css.

queries/analytics/event/getEventData.ts

@@ -38,17 +38,17 @@ async function relationalQuery(
   },
 ) {
   const { startDate, endDate, eventName, columns, filters } = data;
-  const { rawQuery, getEventDataColumnsQuery, getEventDataFilterQuery } = prisma;
-  const params = [startDate, endDate];
+  const { toUuid, rawQuery, getEventDataColumnsQuery, getEventDataFilterQuery } = prisma;
+  const params: any = [websiteId, startDate, endDate, eventName];
 
   return rawQuery(
     `select
       ${getEventDataColumnsQuery('event_data', columns)}
     from website_event
-    where website_id ='${websiteId}'
-      and created_at between $1 and $2
+    where website_id = $1${toUuid()}
+      and created_at between $2 and $3
       and event_type = ${EVENT_TYPE.customEvent}
-      ${eventName ? `and eventName = ${eventName}` : ''}
+      ${eventName ? `and eventName = $4` : ''}
       ${
         Object.keys(filters).length > 0
           ? `and ${getEventDataFilterQuery('event_data', filters)}`
@@ -72,14 +72,14 @@ async function clickhouseQuery(
   const { rawQuery, getBetweenDates, getEventDataColumnsQuery, getEventDataFilterQuery } =
     clickhouse;
   const website = await cache.fetchWebsite(websiteId);
-  const params = [websiteId, website?.revId || 0];
+  const params = { websiteId, revId: website?.revId || 0 };
 
   return rawQuery(
     `select
       ${getEventDataColumnsQuery('event_data', columns)}
     from event
-    where website_id = $1
-      and rev_id = $2
+    where website_id = {websiteId:UUID}
+      and rev_id = {revId:UInt32}
       and event_type = ${EVENT_TYPE.customEvent}
       ${eventName ? `and eventName = ${eventName}` : ''}
       and ${getBetweenDates('created_at', startDate, endDate)}

queries/analytics/event/getEventMetrics.ts

@@ -45,8 +45,8 @@ async function relationalQuery(
     };
   },
 ) {
-  const { rawQuery, getDateQuery, getFilterQuery } = prisma;
-  const params = [startDate, endDate];
+  const { toUuid, rawQuery, getDateQuery, getFilterQuery } = prisma;
+  const params: any = [websiteId, startDate, endDate];
 
   return rawQuery(
     `select
@@ -54,8 +54,8 @@ async function relationalQuery(
       ${getDateQuery('created_at', unit, timezone)} t,
       count(*) y
     from website_event
-    where website_id='${websiteId}'
-      and created_at between $1 and $2
+    where website_id = $1${toUuid()}
+      and created_at between $2 and $3
       and event_type = ${EVENT_TYPE.customEvent}
       ${getFilterQuery(filters, params)}
     group by 1, 2
@@ -85,7 +85,7 @@ async function clickhouseQuery(
 ) {
   const { rawQuery, getDateQuery, getBetweenDates, getFilterQuery } = clickhouse;
   const website = await cache.fetchWebsite(websiteId);
-  const params = [websiteId, website?.revId || 0];
+  const params = { websiteId, revId: website?.revId || 0 };
 
   return rawQuery(
     `select
@@ -93,8 +93,8 @@ async function clickhouseQuery(
       ${getDateQuery('created_at', unit, timezone)} t,
       count(*) y
     from event
-    where website_id = $1
-      and rev_id = $2
+    where website_id = {websiteId:UUID}
+    and rev_id = {revId:UInt32}
       and event_type = ${EVENT_TYPE.customEvent}
       and ${getBetweenDates('created_at', startDate, endDate)}
       ${getFilterQuery(filters, params)}

queries/analytics/event/getEvents.ts

@@ -1,29 +1,30 @@
 import prisma from 'lib/prisma';
 import clickhouse from 'lib/clickhouse';
 import { runQuery, CLICKHOUSE, PRISMA } from 'lib/db';
+import { EVENT_TYPE } from 'lib/constants';
 
-export function getEvents(...args) {
+export function getEvents(...args: [websites: string[], startAt: Date]) {
   return runQuery({
     [PRISMA]: () => relationalQuery(...args),
     [CLICKHOUSE]: () => clickhouseQuery(...args),
   });
 }
 
-function relationalQuery(websites, start_at) {
+function relationalQuery(websites: string[], startAt: Date) {
   return prisma.client.event.findMany({
     where: {
       websiteId: {
         in: websites,
       },
       createdAt: {
-        gte: start_at,
+        gte: startAt,
       },
     },
   });
 }
 
-function clickhouseQuery(websites, start_at) {
-  const { rawQuery, getDateFormat, getCommaSeparatedStringFormat } = clickhouse;
+function clickhouseQuery(websites: string[], startAt: Date) {
+  const { rawQuery } = clickhouse;
 
   return rawQuery(
     `select
@@ -34,12 +35,12 @@ function clickhouseQuery(websites, start_at) {
       url,
       event_name
     from event
-    where event_name != ''
-      and ${
-        websites && websites.length > 0
-          ? `website_id in (${getCommaSeparatedStringFormat(websites)})`
-          : '0 = 0'
-      }
-      and created_at >= ${getDateFormat(start_at)}`,
+    where event_type = ${EVENT_TYPE.customEvent}
+      and ${websites && websites.length > 0 ? `website_id in {websites:Array(UUID)}` : '0 = 0'}
+      and created_at >= {startAt:DateTime('UTC')}`,
+    {
+      websites,
+      startAt,
+    },
   );
 }