@blogic-cz/agent-tools 0.14.44 → 0.14.45

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blogic-cz/agent-tools",
-  "version": "0.14.44",
+  "version": "0.14.45",
   "description": "CLI tools for AI coding agent workflows — GitHub, database, Kubernetes, Azure DevOps, logs, sessions, and audit",
   "keywords": [
     "agent",

package/schemas/agent-tools.schema.json

@@ -291,6 +291,13 @@
               "$ref": "#/definitions/DbMutationOperation"
             }
           }
+        },
+        "allowedMutationTargets": {
+          "description": "Explicitly allowed SQL mutation targets per environment and operation. Use normalized schema-qualified names such as ticker.TimeTickers.",
+          "type": "object",
+          "additionalProperties": {
+            "$ref": "#/definitions/DbAllowedMutationTargets"
+          }
         }
       },
       "required": ["environments"]
@@ -591,6 +598,30 @@
       "description": "SQL mutation operation that can be explicitly allowed for a database environment.",
       "type": "string",
       "enum": ["insert", "update", "delete"]
+    },
+    "DbAllowedMutationTargets": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "insert": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "update": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "delete": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      }
     }
   },
   "examples": [
@@ -640,6 +671,11 @@
           "remotePort": 5432,
           "allowedMutations": {
             "test": ["insert"]
+          },
+          "allowedMutationTargets": {
+            "prod": {
+              "insert": ["ticker.TimeTickers"]
+            }
           }
         }
       },

package/src/config/index.ts

@@ -3,6 +3,7 @@ export type {
   AzureConfig,
   K8sConfig,
   DbEnvConfig,
+  DbAllowedMutationTargets,
   DbMutationOperation,
   DatabaseConfig,
   ObservabilityConfig,

package/src/config/loader.ts

@@ -96,11 +96,20 @@ const DbEnvConfigSchema = Schema.Struct({
   vpn: Schema.optionalKey(Schema.String),
 });
 
+const DbAllowedMutationTargetsSchema = Schema.Struct({
+  insert: Schema.optionalKey(Schema.Array(Schema.String)),
+  update: Schema.optionalKey(Schema.Array(Schema.String)),
+  delete: Schema.optionalKey(Schema.Array(Schema.String)),
+});
+
 const DatabaseConfigSchema = Schema.Struct({
   environments: Schema.Record(Schema.String, DbEnvConfigSchema),
   allowedMutations: Schema.optionalKey(
     Schema.Record(Schema.String, Schema.Array(DbMutationOperationSchema)),
   ),
+  allowedMutationTargets: Schema.optionalKey(
+    Schema.Record(Schema.String, DbAllowedMutationTargetsSchema),
+  ),
   kubectl: Schema.optionalKey(
     Schema.Struct({
       kubeconfig: Schema.optionalKey(Schema.String),

package/src/config/types.ts

@@ -95,6 +95,7 @@ export type DbEnvConfig = ProfilePrerequisites & {
 /** SQL mutation operation that can be explicitly allowed for a database environment. */
 export const DbMutationOperationSchema = Schema.Literals(["insert", "update", "delete"]);
 export type DbMutationOperation = Schema.Schema.Type<typeof DbMutationOperationSchema>;
+export type DbAllowedMutationTargets = Partial<Record<DbMutationOperation, readonly string[]>>;
 
 /** Database profile configuration */
 export type DatabaseConfig = ProfilePrerequisites & {
@@ -102,6 +103,7 @@ export type DatabaseConfig = ProfilePrerequisites & {
   environments: Record<string, DbEnvConfig>;
   /** Explicitly allowed SQL mutation operations per environment. Non-local environments default to read-only. */
   allowedMutations?: Record<string, readonly DbMutationOperation[]>;
+  allowedMutationTargets?: Record<string, DbAllowedMutationTargets>;
   kubectl?: {
     /** Optional kubeconfig path. Supports ${ENV_VAR} templates. */
     kubeconfig?: string;

package/src/db-tool/security.ts

@@ -17,6 +17,13 @@ const ALLOWABLE_MUTATION_PATTERNS: Array<[DbMutationOperation, RegExp]> = [
 ];
 
 const TABLE_NAME_PATTERN = /^[a-zA-Z_][a-zA-Z0-9_]*(\.[a-zA-Z_][a-zA-Z0-9_]*)?$/;
+const IDENTIFIER_PATTERN = String.raw`(?:"[^"]+"|[a-zA-Z_][a-zA-Z0-9_]*)`;
+const QUALIFIED_IDENTIFIER_PATTERN = `${IDENTIFIER_PATTERN}(?:\\s*\\.\\s*${IDENTIFIER_PATTERN})?`;
+const MUTATION_TARGET_PATTERNS: Array<[DbMutationOperation, RegExp]> = [
+  ["insert", new RegExp(String.raw`^\s*INSERT\s+INTO\s+(${QUALIFIED_IDENTIFIER_PATTERN})`, "i")],
+  ["update", new RegExp(String.raw`^\s*UPDATE\s+(${QUALIFIED_IDENTIFIER_PATTERN})`, "i")],
+  ["delete", new RegExp(String.raw`^\s*DELETE\s+FROM\s+(${QUALIFIED_IDENTIFIER_PATTERN})`, "i")],
+];
 
 /**
  * Strip SQL comments (block and line) while preserving string literals.
@@ -89,6 +96,27 @@ export function getAllowedMutationOperation(sql: string): DbMutationOperation |
   return ALLOWABLE_MUTATION_PATTERNS.find(([, pattern]) => pattern.test(stripped))?.[0];
 }
 
+function normalizeSqlIdentifier(identifier: string): string {
+  return identifier
+    .split(".")
+    .map((part) =>
+      part
+        .trim()
+        .replace(/^"(.+)"$/, "$1")
+        .replace(/""/g, '"'),
+    )
+    .join(".");
+}
+
+export function getMutationTarget(sql: string): string | undefined {
+  const stripped = stripSqlComments(sql);
+  const operation = getAllowedMutationOperation(stripped);
+  const pattern = MUTATION_TARGET_PATTERNS.find(([candidate]) => candidate === operation)?.[1];
+  const target = pattern?.exec(stripped)?.[1];
+
+  return target === undefined ? undefined : normalizeSqlIdentifier(target);
+}
+
 export function isValidTableName(tableName: string): boolean {
   return TABLE_NAME_PATTERN.test(tableName);
 }

package/src/db-tool/service.ts

@@ -28,6 +28,7 @@ import {
 import {
   detectSchemaError,
   getAllowedMutationOperation,
+  getMutationTarget,
   isValidTableName,
   isMutationQuery,
 } from "./security";
@@ -712,6 +713,7 @@ export class DbService extends Context.Service<
             needsTunnel: accessMode.needsTunnel,
             allowMutations: accessMode.allowMutations,
             allowedMutations: accessMode.allowedMutations,
+            allowedMutationTargets: dbConfig.allowedMutationTargets?.[env] ?? {},
           };
         });
 
@@ -725,11 +727,17 @@ export class DbService extends Context.Service<
           const password = yield* resolvePassword(resolvedConfig, env);
           const mutation = isMutationQuery(sql);
           const mutationOperation = mutation ? getAllowedMutationOperation(sql) : undefined;
+          const mutationTarget = mutation ? getMutationTarget(sql) : undefined;
           const mutationAllowed =
             !mutation ||
             resolvedConfig.allowMutations ||
             (mutationOperation !== undefined &&
-              resolvedConfig.allowedMutations.includes(mutationOperation));
+              resolvedConfig.allowedMutations.includes(mutationOperation)) ||
+            (mutationOperation !== undefined &&
+              mutationTarget !== undefined &&
+              (resolvedConfig.allowedMutationTargets[mutationOperation] ?? []).includes(
+                mutationTarget,
+              ));
 
           if (!mutationAllowed) {
             const allowed =
@@ -739,7 +747,7 @@ export class DbService extends Context.Service<
             return yield* new DbMutationBlockedError({
               message: `Mutation queries are not allowed on environment ${env}. Allowed mutation operations: ${allowed}.`,
               environment: env,
-              hint: 'Configure database.<profile>.allowedMutations.<env> with explicit operations such as ["insert"] if this environment should allow controlled mutations.',
+              hint: 'Configure database.<profile>.allowedMutationTargets.<env> with explicit targets such as { insert: ["ticker.TimeTickers"] }, or allowedMutations.<env> for broader operation-level access.',
             });
           }
 

package/src/db-tool/types.ts

@@ -1,5 +1,8 @@
-import type { DbMutationOperation } from "#config";
-import type { ProfilePrerequisites } from "#config/types";
+import type {
+  DbAllowedMutationTargets,
+  DbMutationOperation,
+  ProfilePrerequisites,
+} from "#config/types";
 import type { Environment, OutputFormat } from "#shared";
 
 export type { DbMutationOperation };
@@ -17,6 +20,7 @@ export type DbConfig = ProfilePrerequisites & {
   needsTunnel: boolean;
   allowMutations: boolean;
   allowedMutations: readonly DbMutationOperation[];
+  allowedMutationTargets: DbAllowedMutationTargets;
 };
 
 export type QueryResult = {