Developer 02 5fc689ee4d Refactor SQL query execution in AddEnvelopeReceiverAsync
Updated the SQL query execution in the EnvelopeReceiverExecutor class to use a formatted SQL string directly with parameters instead of a parameterized query method. This change simplifies the execution but may introduce SQL injection risks and affect performance.
2025-05-07 13:14:40 +02:00

37 lines
1.6 KiB
C#

using Dapper;
using EnvelopeGenerator.Application.Contracts.Repositories;
using EnvelopeGenerator.Application.Contracts.SQLExecutor;
using EnvelopeGenerator.Application.SQL;
using EnvelopeGenerator.Domain.Entities;
using Microsoft.Data.SqlClient;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.Logging;
using Microsoft.Extensions.Options;
namespace EnvelopeGenerator.Infrastructure.Executor;
public class EnvelopeReceiverExecutor: SQLExecutor, IEnvelopeReceiverExecutor
{
private readonly IEnvelopeReceiverRepository _erRepository;
public EnvelopeReceiverExecutor(IServiceProvider provider, IOptions<SQLExecutorParams> sqlExecutorParamsOptions, IEnvelopeReceiverRepository erRepository) : base(provider, sqlExecutorParamsOptions)
{
_erRepository = erRepository;
}
public async Task<EnvelopeReceiver?> AddEnvelopeReceiverAsync(string envelope_uuid, string emailAddress, string? salutation, string? phone = null, CancellationToken cancellation = default)
{
using var connection = new SqlConnection(Params.ConnectionString);
var sql = Provider.GetRequiredService<EnvelopeReceiverAddReadSQL>();
var formattedSql = string.Format(sql.Raw, envelope_uuid.ToSqlParam(), emailAddress.ToSqlParam(), salutation.ToSqlParam(), phone.ToSqlParam());
await connection.OpenAsync(cancellation);
var envelopeReceivers = await connection.QueryAsync<EnvelopeReceiver>(formattedSql);
var er = envelopeReceivers.FirstOrDefault();
if (er is null)
return null;
return await _erRepository.ReadByIdAsync(envelopeId: er.EnvelopeId, receiverId: er.ReceiverId);
}
}