@bytebase/dbhub 0.21.0 → 0.21.2

package/README.md

@@ -117,4 +117,10 @@ See [Testing](.claude/skills/testing/SKILL.md) and [Debug](https://dbhub.ai/conf
 
 ## Star History
 
-![Star History Chart](https://api.star-history.com/svg?repos=bytebase/dbhub&type=Date)
+<a href="https://www.star-history.com/?repos=bytebase%2Fdbhub&type=date&legend=top-left">
+ <picture>
+   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=bytebase/dbhub&type=date&theme=dark&legend=top-left" />
+   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/chart?repos=bytebase/dbhub&type=date&legend=top-left" />
+   <img alt="Star History Chart" src="https://api.star-history.com/chart?repos=bytebase/dbhub&type=date&legend=top-left" />
+ </picture>
+</a>

package/dist/{chunk-GRGEI5QT.js → chunk-7D6RKVK2.js}

@@ -1,3 +1,6 @@
+import {
+  isDriverNotInstalled
+} from "./chunk-WVVMH6FJ.js";
 import {
   ConnectorRegistry,
   SafeURL,
@@ -1314,8 +1317,18 @@ function buildDSNFromSource(source) {
 }
 
 // src/utils/aws-rds-signer.ts
-import { Signer } from "@aws-sdk/rds-signer";
 async function generateRdsAuthToken(params) {
+  let Signer;
+  try {
+    ({ Signer } = await import("@aws-sdk/rds-signer"));
+  } catch (error) {
+    if (isDriverNotInstalled(error, "@aws-sdk/rds-signer")) {
+      throw new Error(
+        'AWS IAM authentication requires the "@aws-sdk/rds-signer" package. Install it with: pnpm add @aws-sdk/rds-signer'
+      );
+    }
+    throw error;
+  }
   const signer = new Signer({
     hostname: params.hostname,
     port: params.port,

package/dist/chunk-WVVMH6FJ.js

@@ -0,0 +1,49 @@
+// src/utils/module-loader.ts
+var MISSING_MODULE_RE = /Cannot find (?:package|module) '([^']+)'/;
+function isDriverNotInstalled(err, driver) {
+  if (!(err instanceof Error) || !("code" in err) || err.code !== "ERR_MODULE_NOT_FOUND") {
+    return false;
+  }
+  const match = err.message.match(MISSING_MODULE_RE);
+  if (!match) {
+    return false;
+  }
+  const missingSpecifier = match[1];
+  return missingSpecifier === driver || missingSpecifier.startsWith(`${driver}/`);
+}
+function isModuleNotFound(err) {
+  if (!(err instanceof Error) || !("code" in err)) {
+    return false;
+  }
+  const code = err.code;
+  return code === "ERR_MODULE_NOT_FOUND" || code === "MODULE_NOT_FOUND";
+}
+async function loadConnectors(connectorModules) {
+  await Promise.all(
+    connectorModules.map(async ({ load, name, driver }) => {
+      try {
+        await load();
+      } catch (err) {
+        if (isDriverNotInstalled(err, driver)) {
+          console.error(
+            `Skipping ${name} connector: driver package "${driver}" not installed.`
+          );
+        } else if (isModuleNotFound(err)) {
+          const msg = err instanceof Error ? err.message : String(err);
+          const match = msg.match(MISSING_MODULE_RE);
+          const missing = match ? match[1] : "unknown";
+          console.error(
+            `Skipping ${name} connector: required dependency "${missing}" not installed.`
+          );
+        } else {
+          throw err;
+        }
+      }
+    })
+  );
+}
+
+export {
+  isDriverNotInstalled,
+  loadConnectors
+};

package/dist/index.js

@@ -12,7 +12,10 @@ import {
   resolveSourceConfigs,
   resolveTomlConfigPath,
   resolveTransport
-} from "./chunk-GRGEI5QT.js";
+} from "./chunk-7D6RKVK2.js";
+import {
+  loadConnectors
+} from "./chunk-WVVMH6FJ.js";
 import {
   quoteQualifiedIdentifier
 } from "./chunk-JFWX35TB.js";
@@ -90,20 +93,76 @@ function createToolSuccessResponse(data, meta = {}) {
 
 // src/utils/allowed-keywords.ts
 var allowedKeywords = {
-  postgres: ["select", "with", "explain", "analyze", "show"],
-  mysql: ["select", "with", "explain", "analyze", "show", "describe", "desc"],
-  mariadb: ["select", "with", "explain", "analyze", "show", "describe", "desc"],
-  sqlite: ["select", "with", "explain", "analyze", "pragma"],
+  postgres: ["select", "with", "explain", "show"],
+  mysql: ["select", "with", "explain", "show", "describe", "desc"],
+  mariadb: ["select", "with", "explain", "show", "describe", "desc"],
+  sqlite: ["select", "with", "explain", "pragma"],
   sqlserver: ["select", "with", "explain", "showplan"]
 };
+var mutatingKeywords = [
+  "insert",
+  "update",
+  "delete",
+  "drop",
+  "alter",
+  "create",
+  "truncate",
+  "merge",
+  "grant",
+  "revoke",
+  "rename"
+];
+var mutatingPattern = new RegExp(
+  `\\b(?:${mutatingKeywords.join("|")})\\b`,
+  "i"
+);
+var mutatingPatternWithReplace = new RegExp(
+  `\\b(?:${mutatingKeywords.join("|")}|replace\\s+(?:(?:low_priority|delayed)\\s+)?into)\\b`,
+  "i"
+);
+var mutatingPatterns = {
+  postgres: mutatingPattern,
+  mysql: mutatingPatternWithReplace,
+  mariadb: mutatingPatternWithReplace,
+  sqlite: mutatingPatternWithReplace,
+  sqlserver: mutatingPattern
+};
+var selectIntoPattern = /\bselect\b[\s\S]+\binto\b/i;
+var explainAnalyzePattern = /^explain\s+(?:\([^)]*\banalyze\b(?!\s*(?:=\s*)?(?:false|off|0)\b)[^)]*\)|\banalyze\b(?!\s*(?:=\s*)?(?:false|off|0)\b)(?:\s+verbose\b)?)/i;
 function isReadOnlySQL(sql, connectorType) {
-  const cleanedSQL = stripCommentsAndStrings(sql, connectorType).trim().toLowerCase();
+  return checkReadOnly(
+    stripCommentsAndStrings(sql, connectorType).trim().toLowerCase(),
+    connectorType
+  );
+}
+function checkReadOnly(cleanedSQL, connectorType) {
   if (!cleanedSQL) {
     return false;
   }
-  const firstWord = cleanedSQL.split(/\s+/)[0];
+  const firstWord = cleanedSQL.match(/\S+/)?.[0] ?? "";
   const keywordList = allowedKeywords[connectorType] || [];
-  return keywordList.includes(firstWord);
+  if (!keywordList.includes(firstWord)) {
+    return false;
+  }
+  if (firstWord === "with") {
+    const pattern = mutatingPatterns[connectorType] ?? mutatingPattern;
+    if (pattern.test(cleanedSQL)) {
+      return false;
+    }
+  }
+  if ((firstWord === "select" || firstWord === "with") && selectIntoPattern.test(cleanedSQL)) {
+    return false;
+  }
+  if (firstWord === "explain") {
+    const m = explainAnalyzePattern.exec(cleanedSQL);
+    if (m) {
+      const afterExplain = cleanedSQL.slice(m[0].length).trim();
+      if (afterExplain && !checkReadOnly(afterExplain, connectorType)) {
+        return false;
+      }
+    }
+  }
+  return true;
 }
 
 // src/requests/store.ts
@@ -1362,7 +1421,7 @@ See documentation for more details on configuring database connections.
     const sources = sourceConfigsData.sources;
     console.error(`Configuration source: ${sourceConfigsData.source}`);
     await connectorManager.connectWithSources(sources);
-    const { initializeToolRegistry: initializeToolRegistry2 } = await import("./registry-XSMMLRC4.js");
+    const { initializeToolRegistry: initializeToolRegistry2 } = await import("./registry-Y755MTUO.js");
     initializeToolRegistry2({
       sources: sourceConfigsData.sources,
       tools: sourceConfigsData.tools
@@ -1407,6 +1466,20 @@ See documentation for more details on configuring database connections.
       app.use(express.json());
       app.use((req, res, next) => {
         const origin = req.headers.origin;
+        if (origin) {
+          const host = (req.headers.host ?? "").split(":")[0].toLowerCase();
+          try {
+            const originHost = new URL(origin).hostname.toLowerCase();
+            if (originHost !== host) {
+              return res.status(403).json({
+                error: "Forbidden",
+                message: "Origin does not match Host header (DNS rebinding protection)"
+              });
+            }
+          } catch {
+            return res.status(400).json({ error: "Bad Request", message: "Malformed Origin header" });
+          }
+        }
         res.header("Access-Control-Allow-Origin", origin || "http://localhost");
         res.header("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
         res.header("Access-Control-Allow-Headers", "Content-Type, Mcp-Session-Id");
@@ -1488,44 +1561,13 @@ See documentation for more details on configuring database connections.
   }
 }
 
-// src/utils/module-loader.ts
-var MISSING_MODULE_RE = /Cannot find (?:package|module) '([^']+)'/;
-function isDriverNotInstalled(err, driver) {
-  if (!(err instanceof Error) || !("code" in err) || err.code !== "ERR_MODULE_NOT_FOUND") {
-    return false;
-  }
-  const match = err.message.match(MISSING_MODULE_RE);
-  if (!match) {
-    return false;
-  }
-  const missingSpecifier = match[1];
-  return missingSpecifier === driver || missingSpecifier.startsWith(`${driver}/`);
-}
-async function loadConnectors(connectorModules2) {
-  await Promise.all(
-    connectorModules2.map(async ({ load, name, driver }) => {
-      try {
-        await load();
-      } catch (err) {
-        if (isDriverNotInstalled(err, driver)) {
-          console.error(
-            `Skipping ${name} connector: driver package "${driver}" not installed.`
-          );
-        } else {
-          throw err;
-        }
-      }
-    })
-  );
-}
-
 // src/index.ts
 var connectorModules = [
-  { load: () => import("./postgres-B7YSSZMH.js"), name: "PostgreSQL", driver: "pg" },
-  { load: () => import("./sqlserver-FDBRUELV.js"), name: "SQL Server", driver: "mssql" },
+  { load: () => import("./postgres-4PCNQDGV.js"), name: "PostgreSQL", driver: "pg" },
+  { load: () => import("./sqlserver-YV3KVJ3B.js"), name: "SQL Server", driver: "mssql" },
   { load: () => import("./sqlite-FSCLCRIH.js"), name: "SQLite", driver: "better-sqlite3" },
-  { load: () => import("./mysql-I35IQ2GH.js"), name: "MySQL", driver: "mysql2" },
-  { load: () => import("./mariadb-VGTS4WXE.js"), name: "MariaDB", driver: "mariadb" }
+  { load: () => import("./mysql-M4INQQ46.js"), name: "MySQL", driver: "mysql2" },
+  { load: () => import("./mariadb-4IBCPIEV.js"), name: "MariaDB", driver: "mariadb" }
 ];
 loadConnectors(connectorModules).then(() => main()).catch((error) => {
   console.error("Fatal error:", error);

package/dist/{mariadb-VGTS4WXE.js → mariadb-4IBCPIEV.js}

@@ -2,6 +2,9 @@ import {
   extractAffectedRows,
   parseQueryResults
 } from "./chunk-RTB262PR.js";
+import {
+  quoteIdentifier
+} from "./chunk-JFWX35TB.js";
 import {
   SQLRowLimiter
 } from "./chunk-BRXZ5ZQB.js";
@@ -352,10 +355,12 @@ var MariaDBConnector = class _MariaDBConnector {
       let definition = procedure.ROUTINE_DEFINITION;
       try {
         const schemaValue = schema || await this.getCurrentSchema();
+        const quotedSchema = quoteIdentifier(schemaValue, "mariadb");
+        const quotedProcName = quoteIdentifier(procedureName, "mariadb");
         if (procedure.procedure_type === "procedure") {
           try {
             const defRows = await this.pool.query(`
-              SHOW CREATE PROCEDURE ${schemaValue}.${procedureName}
+              SHOW CREATE PROCEDURE ${quotedSchema}.${quotedProcName}
             `);
             if (defRows && defRows.length > 0) {
               definition = defRows[0]["Create Procedure"];
@@ -366,7 +371,7 @@ var MariaDBConnector = class _MariaDBConnector {
         } else {
           try {
             const defRows = await this.pool.query(`
-              SHOW CREATE FUNCTION ${schemaValue}.${procedureName}
+              SHOW CREATE FUNCTION ${quotedSchema}.${quotedProcName}
             `);
             if (defRows && defRows.length > 0) {
               definition = defRows[0]["Create Function"];

package/dist/{mysql-I35IQ2GH.js → mysql-M4INQQ46.js}

@@ -2,6 +2,9 @@ import {
   extractAffectedRows,
   parseQueryResults
 } from "./chunk-RTB262PR.js";
+import {
+  quoteIdentifier
+} from "./chunk-JFWX35TB.js";
 import {
   SQLRowLimiter
 } from "./chunk-BRXZ5ZQB.js";
@@ -358,10 +361,12 @@ var MySQLConnector = class _MySQLConnector {
       let definition = procedure.ROUTINE_DEFINITION;
       try {
         const schemaValue = schema || await this.getCurrentSchema();
+        const quotedSchema = quoteIdentifier(schemaValue, "mysql");
+        const quotedProcName = quoteIdentifier(procedureName, "mysql");
         if (procedure.procedure_type === "procedure") {
           try {
             const [defRows] = await this.pool.query(`
-              SHOW CREATE PROCEDURE ${schemaValue}.${procedureName}
+              SHOW CREATE PROCEDURE ${quotedSchema}.${quotedProcName}
             `);
             if (defRows && defRows.length > 0) {
               definition = defRows[0]["Create Procedure"];
@@ -372,7 +377,7 @@ var MySQLConnector = class _MySQLConnector {
         } else {
           try {
             const [defRows] = await this.pool.query(`
-              SHOW CREATE FUNCTION ${schemaValue}.${procedureName}
+              SHOW CREATE FUNCTION ${quotedSchema}.${quotedProcName}
             `);
             if (defRows && defRows.length > 0) {
               definition = defRows[0]["Create Function"];

package/dist/{postgres-B7YSSZMH.js → postgres-4PCNQDGV.js}

@@ -303,7 +303,7 @@ var PostgresConnector = class _PostgresConnector {
         JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
         WHERE c.relname = $1
         AND n.nspname = $2
-        AND c.relkind IN ('r','p','m','f')
+        AND c.relkind IN ('r','p','m','f','v')
       `,
         [tableName, schemaToUse]
       );

package/dist/{registry-XSMMLRC4.js → registry-Y755MTUO.js}

@@ -2,7 +2,8 @@ import {
   ToolRegistry,
   getToolRegistry,
   initializeToolRegistry
-} from "./chunk-GRGEI5QT.js";
+} from "./chunk-7D6RKVK2.js";
+import "./chunk-WVVMH6FJ.js";
 import "./chunk-C7WEAPX4.js";
 export {
   ToolRegistry,

package/dist/{sqlserver-FDBRUELV.js → sqlserver-YV3KVJ3B.js}

@@ -1,3 +1,6 @@
+import {
+  isDriverNotInstalled
+} from "./chunk-WVVMH6FJ.js";
 import {
   SQLRowLimiter
 } from "./chunk-BRXZ5ZQB.js";
@@ -9,7 +12,6 @@ import {
 
 // src/connectors/sqlserver/index.ts
 import sql from "mssql";
-import { DefaultAzureCredential } from "@azure/identity";
 var SQLServerDSNParser = class {
   async parse(dsn, config) {
     const connectionTimeoutSeconds = config?.connectionTimeoutSeconds;
@@ -74,6 +76,17 @@ Expected: ${expectedFormat}`
       };
       switch (options.authentication) {
         case "azure-active-directory-access-token": {
+          let DefaultAzureCredential;
+          try {
+            ({ DefaultAzureCredential } = await import("@azure/identity"));
+          } catch (importError) {
+            if (isDriverNotInstalled(importError, "@azure/identity")) {
+              throw new Error(
+                'Azure AD authentication requires the "@azure/identity" package. Install it with: pnpm add @azure/identity'
+              );
+            }
+            throw importError;
+          }
           try {
             const credential = new DefaultAzureCredential();
             const token = await credential.getToken("https://database.windows.net/");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bytebase/dbhub",
-  "version": "0.21.0",
+  "version": "0.21.2",
   "mcpName": "io.github.bytebase/dbhub",
   "description": "Minimal, token-efficient Database MCP Server for PostgreSQL, MySQL, SQL Server, SQLite, MariaDB",
   "repository": {
@@ -30,7 +30,8 @@
     "test": "vitest run",
     "test:unit": "vitest run --project unit",
     "test:watch": "vitest",
-    "test:integration": "vitest run --project integration"
+    "test:integration": "vitest run --project integration",
+    "test:build": "node scripts/smoke-test-build.mjs"
   },
   "engines": {
     "node": ">=20"
@@ -39,8 +40,6 @@
   "author": "",
   "license": "MIT",
   "dependencies": {
-    "@aws-sdk/rds-signer": "^3.1001.0",
-    "@azure/identity": "^4.8.0",
     "@iarna/toml": "^2.2.5",
     "@modelcontextprotocol/sdk": "^1.25.1",
     "dotenv": "^16.4.7",
@@ -50,6 +49,8 @@
     "zod": "^3.24.2"
   },
   "optionalDependencies": {
+    "@aws-sdk/rds-signer": "^3.1001.0",
+    "@azure/identity": "^4.8.0",
     "better-sqlite3": "^11.9.0",
     "mariadb": "^3.4.0",
     "mssql": "^11.0.1",