refactor: resolveSortColumn is exported but never called in executeSelectQuery

[Justus-at-Tazama]

Summary

resolveSortColumn was introduced in PR #299 to safely validate user-supplied sortBy column names against the database schema and the query AST before injecting them into an ORDER BY clause. However, executeSelectQuery never calls it - the function is dead exported code.

Affected file

src/services/node.logic.service.ts

Detail

The function validates a sortBy string in three ways:

1. Regex check: must match ^[A-Za-z_][A-Za-z0-9_]*$
2. AST check: the column must appear in the query's ORDER BY clause
3. DB schema check: the column must exist in information_schema.columns for at least one of the query's base tables

All three checks are sound. The problem is that executeSelectQuery does not accept a sortBy parameter and never passes one through to resolveSortColumn.

Risk

Low immediate risk - the function is unreachable. However:

• Dead exported code can mislead a future contributor into thinking sortBy injection is already guarded.
• If someone adds a sortBy parameter to executeSelectQuery without remembering to call resolveSortColumn, they may inject an unvalidated column name into an ORDER BY clause.

Recommended action

Choose one of:

1. Wire it up: Add sortBy?: string to the executeSelectQuery input, call resolveSortColumn, and inject a validated ORDER BY into innerQuery before the outer LIMIT wrapper.
2. Remove it: If sortBy injection is not planned for this service, delete the function to avoid confusion. Open a follow-up issue if it is wanted.
3. Document the intent: If this is scaffolding for a future PR, add a // TODO(#<issue>): comment referencing the tracking issue.

Related

• PR fix: query node issues and add test cases #299
• Issue [BUG] Improve existing functionality to fix SQL injection vulnerabilities #263