title: Objection.js: Can all where clauses be enclosed in parentheses after they have been added?
body: Code example
  <pre class="lang-js prettyprint-override"><code>// Creates an Objection query. 
  // I have no control over the creation of the query. I can only modify the query after it has been created.
  // Example: &quot;select `todos`.* from `todos` where `text` = ?&quot;
  const objectionQuery = thirdPartyService.createQuery(userControlledInput);
  // Adds an access check. Example &quot;select `todos`.* from `todos` where `text` = ? and `userId` = ?&quot;
  objectionQuery.andWhere(&quot;userId&quot;, currentUser.id);
  </code></pre>
  <p>The above example has a security bug. If the <code>thirdPartyService</code> generates a query like this:</p>
  <pre class="lang-sql prettyprint-override"><code>select `todos`.* from `todos` where `text` = ? or `id` = ?
  </code></pre>
  <p>Then after adding the access check we will get the following query:</p>
  <pre class="lang-sql prettyprint-override"><code>select `todos`.* from `todos` where `text` = ? or `id` = ? and `userId` = ?
  </code></pre>
  <p>And this query can return data that doesn't belong to the current user.
  To fix this bug, we need to enclose the user-controlled conditions in parentheses:</p>
  <pre class="lang-sql prettyprint-override"><code>select `todos`.* from `todos` where (`text` = ? or `id` = ?) and `userId` = ?
  </code></pre>
  <p><strong>But how do I do this with the Objection query builder?</strong> I imagine something like this:</p>
  <pre class="lang-js prettyprint-override"><code>const objectionQuery = thirdPartyService.createQuery(userControlledInput);
  wrapWhereClauses(objectionQuery);
  objectionQuery.andWhere(&quot;userId&quot;, currentUser.id);
  </code></pre>