@amerged/ohmyhost-mcp 0.1.10

package/src/apps/product-cli/project-link-store.ts

@@ -0,0 +1,30 @@
+import { chmod, mkdir, rename, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+
+export interface ProjectLinkMetadata {
+  readonly version: 1;
+  readonly api_origin: string;
+  readonly project_id: string;
+  readonly installation_id: string;
+  readonly repository_full_name: string;
+  readonly commit_sha?: string;
+}
+
+export interface ProjectLinkStore {
+  save(metadata: ProjectLinkMetadata): Promise<void>;
+}
+
+export class OwnerOnlyProjectLinkStore implements ProjectLinkStore {
+  public constructor(private readonly directory: string) {}
+
+  public async save(metadata: ProjectLinkMetadata): Promise<void> {
+    await mkdir(this.directory, { mode: 0o700, recursive: true });
+    await chmod(this.directory, 0o700);
+    const target = join(this.directory, "link.json");
+    const temporary = join(this.directory, `.link-${process.pid}.tmp`);
+    await writeFile(temporary, `${JSON.stringify(metadata)}\n`, { encoding: "utf8", mode: 0o600 });
+    await chmod(temporary, 0o600);
+    await rename(temporary, target);
+    await chmod(target, 0o600);
+  }
+}

package/src/apps/product-cli/psql-session.ts

@@ -0,0 +1,29 @@
+import { spawn } from "node:child_process";
+
+import { PsqlUnavailableError } from "./cli.js";
+
+/**
+ * Starts the customer's own psql against a temporary database credential.
+ * The password reaches psql only through its private environment, never through
+ * argv, the terminal title or any file; no authentication credential is involved.
+ */
+export const runLocalPsql = (input: {
+  readonly host: string;
+  readonly user: string;
+  readonly password: string;
+  readonly database: string;
+  readonly signal: AbortSignal;
+}): Promise<number> =>
+  new Promise<number>((resolve, reject) => {
+    const child = spawn("psql", ["-h", input.host, "-U", input.user, "-d", input.database], {
+      stdio: "inherit",
+      signal: input.signal,
+      env: { ...process.env, PGPASSWORD: input.password, PGSSLMODE: "require" },
+    });
+    child.once("error", (error: NodeJS.ErrnoException) => {
+      reject(error.code === "ENOENT" ? new PsqlUnavailableError() : error);
+    });
+    child.once("close", (code, signalName) => {
+      resolve(code ?? (signalName === null ? 1 : 130));
+    });
+  });