From b3f09219ab484c2da4a52a1cc57aa7e420046aed Mon Sep 17 00:00:00 2001
From: t8y2 <1156263951@qq.com>
Date: Wed, 8 Jul 2026 00:21:27 +0800
Subject: [PATCH] fix(sql): cover MySQL dynamic SQL variables

---
 .../lib/__tests__/sql/sqlParameters.spec.ts   | 32 +++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/apps/desktop/src/lib/__tests__/sql/sqlParameters.spec.ts b/apps/desktop/src/lib/__tests__/sql/sqlParameters.spec.ts
index c748abafd6..ea262c9b53 100644
--- a/apps/desktop/src/lib/__tests__/sql/sqlParameters.spec.ts
+++ b/apps/desktop/src/lib/__tests__/sql/sqlParameters.spec.ts
@@ -147,6 +147,23 @@ describe("extractSqlParameters", () => {
     expect(extractSqlParameters(sql)).toEqual([]);
   });
 
+  it("ignores MySQL dynamic SQL variables used by prepared statements", () => {
+    const sql = `
+      SET @sql = IF(
+        (SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS
+         WHERE TABLE_SCHEMA = DATABASE()
+           AND TABLE_NAME = 'oem_user_group'
+           AND COLUMN_NAME = 'group') = 0,
+        'ALTER TABLE \`oem_user_group\` ADD COLUMN \`group\` varchar(64) DEFAULT NULL COMMENT ''users.group'' AFTER \`oem_id\`',
+        'SELECT 1'
+      );
+      PREPARE stmt FROM @sql;
+      EXECUTE stmt;
+      DEALLOCATE PREPARE stmt;
+    `;
+    expect(extractSqlParameters(sql)).toEqual([]);
+  });
+
   it("stops SQL Server declaration scanning when a new statement starts without a semicolon", () => {
     const sql = `
       declare @id int = 1
@@ -223,6 +240,21 @@ describe("substituteSqlParameters", () => {
     expect(substituteSqlParameters(sql, {})).toBe(sql);
   });
 
+  it("preserves MySQL dynamic SQL variables used by prepared statements", () => {
+    const sql = `SET @sql = IF(
+  (SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS
+   WHERE TABLE_SCHEMA = DATABASE()
+     AND TABLE_NAME = 'oem_user_group'
+     AND COLUMN_NAME = 'group') = 0,
+  'ALTER TABLE \`oem_user_group\` ADD COLUMN \`group\` varchar(64) DEFAULT NULL COMMENT ''users.group'' AFTER \`oem_id\`',
+  'SELECT 1'
+);
+PREPARE stmt FROM @sql;
+EXECUTE stmt;
+DEALLOCATE PREPARE stmt;`;
+    expect(substituteSqlParameters(sql, {})).toBe(sql);
+  });
+
   it("leaves named stored procedure arguments untouched while replacing their template values", () => {
     const sql = "exec dbo.search_orders @date_start = '2026-07-04', @status = @status_value, @tenant_id = @tenant_id";
     expect(