@bakery-framework/plugin-db-explorer 2.0.0-alpha.3 → 2.0.0-alpha.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bakery-framework/plugin-db-explorer",
-  "version": "2.0.0-alpha.3",
+  "version": "2.0.0-alpha.5",
   "description": "Bakery database explorer plugin — read-only browsing of the app database.",
   "keywords": [
     "bakery",
@@ -33,8 +33,8 @@
     "!src/tests"
   ],
   "dependencies": {
-    "@bakery-framework/core": "^2.0.0-alpha.3",
-    "@bakery-framework/orm": "^2.0.0-alpha.3"
+    "@bakery-framework/core": "^2.0.0-alpha.5",
+    "@bakery-framework/orm": "^2.0.0-alpha.5"
   },
   "engines": {
     "bun": ">=1.3.14"

package/src/credential.ts

@@ -0,0 +1,26 @@
+import { requestHasCredential } from '@bakery-framework/core/utils/http'
+
+/**
+ * Shared-credential access: `dbExplorerPlugin({ credential: import.meta.env
+ * .DB_EXPLORER_KEY })`, presented as `x-db-key`, a Bearer token, or a
+ * one-time `?db-key=` query the client strips from the URL. The comparison
+ * lives in core (`requestHasCredential`) — one copy, shared with analytics;
+ * this only names the key, `db-key`.
+ *
+ * Named `hasDbKey`, not `credentialMatches`, deliberately. Core exports a
+ * `credentialMatches` of its own from the very barrel this file imports
+ * (`@bakery-framework/core/utils/http`), and it takes
+ * `(configured, presented: string | null | undefined)` where this takes
+ * `(credential, req: Request)`. Two same-named functions with the same arity
+ * and a different second parameter, one of them reachable by wildcard from a
+ * module every caller here already imports, is a trap: the compiler catches
+ * the direct substitution today only because `Request` is not assignable to
+ * `string | null | undefined`, which is a coincidence of the current types
+ * rather than a guarantee. The distinct name removes the question.
+ */
+export function hasDbKey(
+  credential: string | undefined,
+  req: Request,
+): boolean {
+  return requestHasCredential(req, credential, 'db-key')
+}

package/src/index.ts

@@ -1,7 +1,12 @@
 import { definePlugin } from '@bakery-framework/core/plugins'
-import type { AuthorizeFn } from './authorize'
+import type { AuthorizeFn } from '@bakery-framework/core/utils/http'
 
-export type { AuthorizeFn } from './authorize'
+/**
+ * Part of this plugin's public surface, and re-exported rather than declared:
+ * the predicate type is core's now, shared with the dashboard and analytics,
+ * so an application can write one `AuthorizeFn` and hand it to all three.
+ */
+export type { AuthorizeFn } from '@bakery-framework/core/utils/http'
 
 export interface DbExplorerPluginOptions {
   /**

package/src/setup.ts

@@ -5,14 +5,14 @@ import { errorMsg } from '@bakery-framework/core/logger'
 import type { PluginRouteTable } from '@bakery-framework/core/plugins'
 import { routeTable } from '@bakery-framework/core/plugins'
 import { fs } from '@bakery-framework/core/utils'
-import { response } from '@bakery-framework/core/utils/http'
 import {
   type AuthorizeFn,
-  credentialMatches,
   defaultAuthorize,
   isAuthorized,
   resolveAuthorize,
-} from './authorize'
+  response,
+} from '@bakery-framework/core/utils/http'
+import { hasDbKey } from './credential'
 import { handleSchema, handleTableData } from './endpoints'
 
 /**
@@ -136,7 +136,7 @@ export class DbExplorerHandler extends Handler {
     // dashboard. Everything else fails closed. Either door admits: the
     // shared credential (constant-time, off when unset) or the predicate.
     const admitted =
-      credentialMatches(credential, req) || (await isAuthorized(authorize, req))
+      hasDbKey(credential, req) || (await isAuthorized(authorize, req))
     if (!/\.(css|js)$/.test(path) && !admitted) {
       return path.startsWith('/api/')
         ? response.error('Unauthorized', 401)

package/src/authorize.ts

@@ -1,82 +0,0 @@
-import {
-  getClientIp,
-  requestHasCredential,
-} from '@bakery-framework/core/utils/http'
-
-/**
- * Decides whether a request may use the explorer.
- *
- * Same design as the dashboard's guard, for the same reason: the explorer
- * authenticates nobody itself. The host application, which already knows who
- * its users are, supplies a predicate; without one, access is loopback-only
- * in development and denied outright in production, so an unconfigured
- * explorer is never exposed.
- */
-export type AuthorizeFn = (req: Request) => boolean | Promise<boolean>
-
-/**
- * Addresses only, never hostnames: a peer address is not the string
- * `localhost`, and matching the request's hostname would trust a header the
- * client chooses (`Host: localhost` from anywhere on the LAN, with the dev
- * server listening on 0.0.0.0).
- */
-const LOOPBACK = new Set(['127.0.0.1', '::1', '::ffff:127.0.0.1'])
-
-/** True when the request came from this machine. */
-export function isLoopback(req: Request): boolean {
-  // The peer address is the only evidence here the client does not choose.
-  // getClientIp reads config and the live server, either of which may be
-  // absent (tests, early boot). An address that cannot be determined is
-  // indeterminate, and per convention 2 an indeterminate answer is a denial —
-  // not a reason to consult something the requester controls.
-  let ip = ''
-  try {
-    ip = getClientIp(req)
-  } catch {
-    return false
-  }
-  return LOOPBACK.has(ip)
-}
-
-/**
- * The default: loopback in dev, nothing in prod. `import.meta.env.PROD` read
- * at call time — the flag is process state, and tests flip it.
- */
-export function defaultAuthorize(req: Request): boolean {
-  if (import.meta.env.PROD) return false
-  return isLoopback(req)
-}
-
-export function resolveAuthorize(fn?: AuthorizeFn): AuthorizeFn {
-  return fn ?? defaultAuthorize
-}
-
-/**
- * Guard semantics per convention 2: the *authorizer* may throw or hang-fail;
- * the answer to any indeterminate state is denial.
- */
-export async function isAuthorized(
-  authorize: AuthorizeFn,
-  req: Request,
-): Promise<boolean> {
-  try {
-    return (await authorize(req)) === true
-  } catch {
-    // A predicate that throws is indeterminate, and indeterminate is denied.
-    return false
-  }
-}
-
-/**
- * Shared-credential access: `dbExplorerPlugin({ credential: import.meta.env
- * .DB_EXPLORER_KEY })`, presented as `x-db-key`, a Bearer token, or a
- * one-time `?db-key=` query the client strips from the URL. The comparison
- * lives in core (`requestHasCredential`) — one copy, shared with analytics;
- * this only names the key, `db-key`.
- */
-export function credentialMatches(
-  credential: string | undefined,
-  req: Request,
-): boolean {
-  return requestHasCredential(req, credential, 'db-key')
-}