Skip to content

Integrate NodeQL as a visual SQL builder for FQLite#25

Merged
pawlaszczyk merged 3 commits into
pawlaszczyk:masterfrom
Kartoffelspalt:master
Jun 15, 2026
Merged

Integrate NodeQL as a visual SQL builder for FQLite#25
pawlaszczyk merged 3 commits into
pawlaszczyk:masterfrom
Kartoffelspalt:master

Conversation

@Kartoffelspalt

Copy link
Copy Markdown
Contributor

Summary

This PR adds NodeQL as an optional visual SQL builder inside FQLite.

FQLite remains the main Forensic SQLite recovery and analysis application. NodeQL is not intended to replace existing FQLite workflows. It is added as an additional query-building layer for users who want to compose SQL visually, especially when working with recovered SQLite data, deleted records, journal/WAL artifacts, or unfamiliar database schemas.

The goal is to make SQL exploration inside FQLite more approachable without reducing the power of the existing SQL Analyzer.

Why this belongs in FQLite

FQLite is used in forensic SQLite analysis, where users often need to inspect unknown or partially recovered database structures. In these situations, writing SQL manually can be repetitive and error-prone:

  • table and column names may be unfamiliar
  • recovered datasets may need quick filtering and sorting
  • investigators may want to build queries step by step
  • less SQL-experienced users still need reliable access to the SQL Analyzer
  • complex queries often start as simple exploratory SELECT statements

NodeQL helps in exactly this area. It gives users a visual way to assemble SQL commands and then passes the generated SQL into FQLite's existing SQL Analyzer. This keeps the current analyzer as the execution point while adding a guided builder in front of it.

In other words: NodeQL does not change the forensic core of FQLite. It improves access to it.

User workflow

The intended workflow is:

  1. Open a SQLite database in FQLite.
  2. Open Analyze > NodeQL Builder... or use the NodeQL toolbar button.
  3. Compose a query using visual SQL blocks.
  4. Snap blocks under EXECUTE QUERY.
  5. Review the generated SQL preview.
  6. Send the generated SQL to FQLite's existing SQL Analyzer.
  7. Execute the query there using the normal FQLite play button.

This keeps execution, result display, and database handling inside FQLite's established SQL Analyzer.

What this PR adds

FQLite UI integration

  • Adds a NodeQL Builder... item under the Analyze menu.
  • Adds a NodeQL toolbar button.
  • Enables the builder only when a SQLite database is open and selected.
  • Shows clear error messages when the builder is opened without a usable database context.

Visual SQL builder

Adds a JavaFX-based builder window with:

  • block palette on the left
  • large workspace / infinite-canvas-style area
  • EXECUTE QUERY snap target
  • generated SQL preview on the right
  • button to send SQL into the existing SQL Analyzer

The builder is styled to fit FQLite as a Forensic SQLite tool, using a light UI instead of a standalone dark visual-editor look.

SQL block coverage

The builder includes block groups for:

  • DQL
  • DML
  • DDL
  • DCL
  • TCL
  • joins and set operations
  • aggregate functions
  • SQL functions

This gives the integration room to support both simple forensic inspection queries and more advanced SQL composition.

Query composition

The SQL generation has been adjusted so SELECT-style chains are assembled in a valid SQL order:

  • SELECT projections
  • FROM table
  • JOIN clauses
  • WHERE conditions
  • GROUP BY
  • HAVING
  • ORDER BY
  • UNION / INTERSECT / EXCEPT

Projection handling was improved so additional selected columns are merged into the SELECT list. If explicit columns are selected, the default * is removed to avoid invalid or misleading queries such as SELECT *, name, id ... when the user clearly selected specific columns.

Interaction improvements

The builder supports:

  • drag and snap behavior
  • block deletion via Delete, Backspace, toolbar button, or block x
  • workspace clear
  • zoom buttons
  • Ctrl/Cmd + scroll zoom
  • trackpad pinch zoom
  • canvas panning
  • undo via Ctrl+Z / Command+Z

Undo currently covers:

  • adding blocks
  • deleting blocks
  • clearing the workspace
  • moving and snapping blocks
  • editing block text fields

This makes the builder feel like a normal desktop editing tool and reduces the risk of losing work while experimenting with queries.

SQL Analyzer behavior

The SQL Analyzer remains the execution surface.

This PR intentionally removes the earlier idea of opening NodeQL project files directly inside the SQL Analyzer. That flow is not useful for FQLite. The correct integration is:

NodeQL Builder -> Generated SQL -> SQL Analyzer -> Execute

…or FQLite

## Summary

This PR adds NodeQL as an optional visual SQL builder inside FQLite.

FQLite remains the main Forensic SQLite recovery and analysis application. NodeQL is not intended to replace existing FQLite workflows. It is added as an additional query-building layer for users who want to compose SQL visually, especially when working with recovered SQLite data, deleted records, journal/WAL artifacts, or unfamiliar database schemas.

The goal is to make SQL exploration inside FQLite more approachable without reducing the power of the existing SQL Analyzer.

## Why this belongs in FQLite

FQLite is used in forensic SQLite analysis, where users often need to inspect unknown or partially recovered database structures. In these situations, writing SQL manually can be repetitive and error-prone:

- table and column names may be unfamiliar
- recovered datasets may need quick filtering and sorting
- investigators may want to build queries step by step
- less SQL-experienced users still need reliable access to the SQL Analyzer
- complex queries often start as simple exploratory SELECT statements

NodeQL helps in exactly this area. It gives users a visual way to assemble SQL commands and then passes the generated SQL into FQLite's existing SQL Analyzer. This keeps the current analyzer as the execution point while adding a guided builder in front of it.

In other words: NodeQL does not change the forensic core of FQLite. It improves access to it.

## User workflow

The intended workflow is:

1. Open a SQLite database in FQLite.
2. Open `Analyze > NodeQL Builder...` or use the `NodeQL` toolbar button.
3. Compose a query using visual SQL blocks.
4. Snap blocks under `EXECUTE QUERY`.
5. Review the generated SQL preview.
6. Send the generated SQL to FQLite's existing SQL Analyzer.
7. Execute the query there using the normal FQLite play button.

This keeps execution, result display, and database handling inside FQLite's established SQL Analyzer.

## What this PR adds

### FQLite UI integration

- Adds a `NodeQL Builder...` item under the Analyze menu.
- Adds a `NodeQL` toolbar button.
- Enables the builder only when a SQLite database is open and selected.
- Shows clear error messages when the builder is opened without a usable database context.

### Visual SQL builder

Adds a JavaFX-based builder window with:

- block palette on the left
- large workspace / infinite-canvas-style area
- `EXECUTE QUERY` snap target
- generated SQL preview on the right
- button to send SQL into the existing SQL Analyzer

The builder is styled to fit FQLite as a Forensic SQLite tool, using a light UI instead of a standalone dark visual-editor look.

### SQL block coverage

The builder includes block groups for:

- DQL
- DML
- DDL
- DCL
- TCL
- joins and set operations
- aggregate functions
- SQL functions

This gives the integration room to support both simple forensic inspection queries and more advanced SQL composition.

### Query composition

The SQL generation has been adjusted so SELECT-style chains are assembled in a valid SQL order:

- SELECT projections
- FROM table
- JOIN clauses
- WHERE conditions
- GROUP BY
- HAVING
- ORDER BY
- UNION / INTERSECT / EXCEPT

Projection handling was improved so additional selected columns are merged into the SELECT list. If explicit columns are selected, the default `*` is removed to avoid invalid or misleading queries such as `SELECT *, name, id ...` when the user clearly selected specific columns.

### Interaction improvements

The builder supports:

- drag and snap behavior
- block deletion via Delete, Backspace, toolbar button, or block `x`
- workspace clear
- zoom buttons
- Ctrl/Cmd + scroll zoom
- trackpad pinch zoom
- canvas panning
- undo via Ctrl+Z / Command+Z

Undo currently covers:

- adding blocks
- deleting blocks
- clearing the workspace
- moving and snapping blocks
- editing block text fields

This makes the builder feel like a normal desktop editing tool and reduces the risk of losing work while experimenting with queries.

### SQL Analyzer behavior

The SQL Analyzer remains the execution surface.

This PR intentionally removes the earlier idea of opening NodeQL project files directly inside the SQL Analyzer. That flow is not useful for FQLite. The correct integration is:

```text
NodeQL Builder -> Generated SQL -> SQL Analyzer -> Execute
@pawlaszczyk pawlaszczyk merged commit 9523013 into pawlaszczyk:master Jun 15, 2026

@pawlaszczyk pawlaszczyk left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi,
Where can I find those imports:

import digital.codespiresolutions.nodeql.BlockNode;
import digital.codespiresolutions.nodeql.BlockType;
import digital.codespiresolutions.nodeql.Position;
import digital.codespiresolutions.nodeql.SqlCompileResult;
import digital.codespiresolutions.nodeql.SqlCompiler.

I couldn't find a jar or the source files?

@Kartoffelspalt

Copy link
Copy Markdown
Contributor Author

@pawlaszczyk I forgot to include them. I created a new PR: #26
The missing classes are included now.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants