test(db): dialect helper refuses malformed column references and day counts

server/tests/unit/db/dialect/sql-functions.test.ts

@@ -41,4 +41,25 @@ describe('sql-functions (sqlite)', () => {
       .execute('get', false);
     expect(String((row as { now: string }).now)).toMatch(/^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}$/);
   });
+
+  it('SQLF-004: dateOf rejects anything that is not a plain column reference', () => {
+    expect(() => dateOf('u.created_at); DROP TABLE users; --')).toThrow(/not a column reference/);
+    expect(() => dateOf('u.created_at.extra')).toThrow(/not a column reference/);
+    expect(() => dateOf('')).toThrow(/not a column reference/);
+  });
+
+  it('SQLF-005: dateAdd rejects a non-integer day count', () => {
+    expect(() => dateAdd('u.created_at', 1.5)).toThrow(/integer day count/);
+    expect(() => dateAdd('u.created_at', Number.NaN)).toThrow(/integer day count/);
+  });
+
+  it('SQLF-006: dateAdd shifts backwards for a negative day count', async () => {
+    const { user } = createUser(testDb);
+    testDb.prepare("UPDATE users SET created_at = '2026-09-21 13:05:09' WHERE id = ?").run(user.id);
+    const row = await t.em.createQueryBuilder(Users, 'u')
+      .select([dateAdd('u.created_at', -10).as('d')])
+      .where({ id: user.id })
+      .execute('get', false);
+    expect(row).toEqual({ d: '2026-09-11' });
+  });
 });