@bakery-framework/plugin-dashboard 2.0.0-alpha.5 → 2.0.0-alpha.6

package/src/endpoints/database.ts

@@ -1,10 +1,22 @@
-import { getElapsed } from '@bakery-framework/core/logger'
-import { processBody } from '@bakery-framework/core/utils'
 import type { JsonResponseData } from '@bakery-framework/core/utils/common'
-import { is, Try } from '@bakery-framework/core/utils/common'
+import { Try } from '@bakery-framework/core/utils/common'
 import { response } from '@bakery-framework/core/utils/http'
 import { connection } from '@bakery-framework/orm/connection'
 
+/**
+ * What is left of the console's database surface: two read-only endpoints.
+ *
+ * The grid editor and the SQL prompt that used to live here are retired —
+ * `@bakery-framework/plugin-db-explorer` does the same work with an access
+ * model instead of an environment flag, and the console's Database tab is now
+ * a link to it. Gone with them: `handleQuery`, `handleExecuteAction`, the
+ * statement classifier in `sql-classify.ts`, and `DASHBOARD_ALLOW_WRITES`.
+ *
+ * The flag is not deprecated, it is *absent*. Nothing here reads it, so
+ * setting it has no effect at all — which is the honest state for a console
+ * that can no longer write.
+ */
+
 export async function handleSchema(): Promise<JsonResponseData<unknown>> {
   return await Try.return(
     async () => response.json.success('success', await connection.getSchema()),
@@ -33,179 +45,3 @@ export async function handleTableData(
     (error: any) => response.json.error(400, error.message),
   )
 }
-
-/**
- * Statements that reach outside the database itself. SQLite's `ATTACH` plus
- * `VACUUM INTO` is an arbitrary file write, which turns any dashboard session
- * (or any XSS in the dashboard origin) into host filesystem access.
- */
-const RX_OUT_OF_BAND_SQL = /\b(attach|detach|vacuum\s+into)\b/i
-
-/**
- * Writes from the dashboard need an explicit opt-in.
- *
- * This gate used to sit only in `handleQuery`, so `DELETE FROM t` typed into
- * the SQL box was refused while the grid's Delete and Truncate buttons — which
- * reach the same rows through `execute-action`, with no SQL to inspect — were
- * not. Half a control is worse than none: the production and security
- * checklists both tell operators that leaving `DASHBOARD_ALLOW_WRITES` unset
- * keeps the console read-only, and that was only ever true of one of its two
- * write paths.
- *
- * Read at call time, not at module load: tests set and restore it, and the
- * flag is a deployment decision rather than a build one.
- */
-function writesEnabled(): boolean {
-  return process.env.DASHBOARD_ALLOW_WRITES === '1'
-}
-
-export async function handleQuery(
-  req: Request,
-): Promise<JsonResponseData<unknown>> {
-  const body = await processBody(req)
-  if (!is.string(body?.sql))
-    return response.json.error(400, 'Invalid SQL query')
-
-  if (RX_OUT_OF_BAND_SQL.test(body.sql)) {
-    return response.json.error(
-      403,
-      'ATTACH / DETACH / VACUUM INTO are not permitted from the dashboard.',
-    )
-  }
-
-  const sqlLower = body.sql.trim().toLowerCase()
-  const isSelect = /^(select|with|show|describe|pragma|explain)/.test(sqlLower)
-
-  // Writes require an explicit opt-in; the browser console should not be a
-  // one-keystroke path to DROP TABLE on a production database.
-  if (!isSelect && !writesEnabled()) {
-    return response.json.error(
-      403,
-      'Write statements are disabled. Set DASHBOARD_ALLOW_WRITES=1 to enable them.',
-    )
-  }
-
-  const start = Bun.nanoseconds()
-
-  return await Try.return(
-    async () => {
-      const result = isSelect
-        ? { rows: await connection.query(body.sql).all(), isSelect: true }
-        : {
-            rows: [
-              (({ lastInsertRowid, changes }) => ({
-                lastInsertRowid,
-                changes,
-              }))(await connection.query(body.sql).run()),
-            ],
-            isSelect: false,
-          }
-
-      return response.json.success('success', {
-        ...result,
-        time: getElapsed(start),
-      })
-    },
-    (error: any) =>
-      response.json.error(400, error.message, { time: getElapsed(start) }),
-  )
-}
-
-/**
- * Every branch answers with the JSON envelope — never a `Response` — so the
- * table is typed as such. `data` stays `unknown`: these payloads are arbitrary
- * database rows, and `unknown` says that honestly where `any` would have let
- * the lie back in.
- */
-const executeActionHandlers: Record<
-  string,
-  (body: any, connection: any) => Promise<JsonResponseData<unknown>>
-> = {
-  'delete-row': async (body, connection) => {
-    if (body.rowid == null) return response.json.error(400, 'Invalid row ID')
-    return await Try.return(
-      async () => {
-        await connection.remove(body.tableName, body.rowid)
-        return response.json.success('Row deleted')
-      },
-      (e: any) => response.json.error(400, e.message),
-    )
-  },
-  truncate: async (body, connection) => {
-    return await Try.return(
-      async () => {
-        await connection.truncate(body.tableName)
-        return response.json.success('Table truncated')
-      },
-      (e: any) => response.json.error(400, e.message),
-    )
-  },
-  'insert-row': async (body, connection) => {
-    if (!body.row || typeof body.row !== 'object')
-      return response.json.error(400, 'Invalid row data')
-    return await Try.return(
-      async () => {
-        await connection.insert(body.tableName, body.row)
-        return response.json.success('Row inserted')
-      },
-      (e: any) => response.json.error(400, e.message),
-    )
-  },
-  'update-row': async (body, connection) => {
-    if (
-      !body.row ||
-      !is.object(body.row) ||
-      Array.isArray(body.row) ||
-      body.rowid == null
-    ) {
-      return response.json.error(400, 'Invalid data or row ID')
-    }
-    return await Try.return(
-      async () => {
-        await connection.update(body.tableName, body.rowid, body.row)
-        return response.json.success('Row updated')
-      },
-      (e: any) => response.json.error(400, e.message),
-    )
-  },
-  'import-csv': async (body, connection) => {
-    if (typeof body.csvContent !== 'string')
-      return response.json.error(400, 'Invalid CSV')
-    return await Try.return(
-      async () => {
-        const info = await connection.importCSV(body.tableName, body.csvContent)
-        return response.json.success(`Imported ${info.changes} rows`, {
-          info,
-        })
-      },
-      (e: any) => response.json.error(400, e.message),
-    )
-  },
-}
-
-export async function handleExecuteAction(
-  req: Request,
-): Promise<JsonResponseData<unknown>> {
-  // Every entry in `executeActionHandlers` writes — truncate and delete-row
-  // destroy data outright — so the gate covers the endpoint rather than being
-  // repeated per action. Checked before the body is even read.
-  if (!writesEnabled()) {
-    return response.json.error(
-      403,
-      'Dashboard writes are disabled. Set DASHBOARD_ALLOW_WRITES=1 to enable them.',
-    )
-  }
-
-  const body = await processBody(req)
-  const { action, tableName } = body || {}
-
-  if (!is.string(tableName) || !/^[a-zA-Z0-9_]+$/.test(tableName)) {
-    return response.json.error(400, 'Invalid table name')
-  }
-
-  const handler = executeActionHandlers[action]
-  if (handler) {
-    return await handler(body, connection)
-  }
-  return response.json.error(400, 'Unknown action')
-}

package/src/setup.ts

@@ -26,12 +26,7 @@ import {
 // the tree, allow-listed by name in `tests/conventions.test.ts`.
 import { setupAnalytics } from '@bakery-framework/plugin-analytics/setup'
 import { isAnalyticsAuthorized } from '@bakery-framework/plugin-analytics/stats'
-import {
-  handleExecuteAction,
-  handleQuery,
-  handleSchema,
-  handleTableData,
-} from './endpoints/database'
+import { handleSchema, handleTableData } from './endpoints/database'
 import {
   handleDeleteSession,
   handleGetSessions,
@@ -209,9 +204,14 @@ async function checkAuthMiddleware(req: Request, path: string) {
  *
  * Necessary but **not sufficient on its own**. `SAFE_METHODS` exempts GET, and
  * `processBody` reads a GET's query string as the body, so a plain
- * `<img src="/api/_dashboard/execute-action?action=truncate&tableName=…">`
- * sails past this guard. The mutating keys in the table below are
- * method-qualified for exactly that reason; neither half closes the hole alone.
+ * `<img src="/api/_dashboard/sessions/delete?id=victim">` sails past this
+ * guard. The mutating keys in the table below are method-qualified for exactly
+ * that reason; neither half closes the hole alone.
+ *
+ * The example used to be `execute-action?action=truncate`, which was the worst
+ * of them — a link that emptied a table. That endpoint is gone with the grid
+ * editor, and the two session routes are what is left to protect. The hazard
+ * is unchanged; only the blast radius shrank.
  */
 function checkCsrfMiddleware(req: Request, url: URL): DashboardResponse | null {
   const reason = checkCsrf(req, url)
@@ -243,8 +243,6 @@ const dashboardRoutes = {
   'POST /api/_dashboard/sessions/update': req => handleUpdateSession(req),
   '/api/_dashboard/schema': () => handleSchema(),
   '/api/_dashboard/table-data': (_req, url) => handleTableData(url),
-  'POST /api/_dashboard/query': req => handleQuery(req),
-  'POST /api/_dashboard/execute-action': req => handleExecuteAction(req),
 } satisfies PluginRouteTable
 
 const dispatchDashboardRoute = routeTable(dashboardRoutes)
@@ -279,5 +277,24 @@ export async function handleDashboardRequest(
   const csrfBlock = checkCsrfMiddleware(req, url)
   if (csrfBlock) return csrfBlock
 
-  return dispatchDashboardRoute(req, url)
+  const result = await dispatchDashboardRoute(req, url)
+  if (result) return result
+
+  // `dispatch` answers `null` for a path no key matched, and a handler
+  // returning `null` means "not mine" — which core turns into **204 No
+  // Content**. Every unmatched request under this namespace therefore answered
+  // 204: a status that reads as success and carries nothing.
+  //
+  // Retiring the write endpoints is what made that matter. A script still
+  // posting to `/api/_dashboard/execute-action` was told 204, took it for
+  // success, and silently changed nothing. For a route that has been deleted
+  // that is the worst available answer.
+  //
+  // **Only under `/api/`, and that boundary is load-bearing.** The stylesheet
+  // is served by `mountRoutes`, not by a key in the table above, so `null` is
+  // precisely how `/_dashboard/style.css` *falls through* to the static
+  // pipeline. A blanket 404 here claims it and the console loads unstyled —
+  // which is what happened when this was first written without the condition.
+  if (path.startsWith('/api/')) return response.error('Not Found', 404)
+  return null
 }