@bytebase/dbhub 1.1.0 → 1.2.1

package/dist/index.js

@@ -12,19 +12,20 @@ import {
   loadTomlConfig,
   mapArgumentsToArray,
   resolveAllowedHosts,
+  resolveAuthTokens,
   resolveHost,
   resolvePort,
   resolveSourceConfigs,
   resolveTomlConfigPath,
   resolveTransport
-} from "./chunk-GSSLHJB6.js";
+} from "./chunk-2DFLBX4D.js";
 import {
   allowedKeywords,
   getFirstKeyword,
   hasEscapeHatchFunction,
   isReadOnlySQL,
   sqlServerDynamicSqlPattern
-} from "./chunk-EPOKWSFC.js";
+} from "./chunk-IQRBLAB4.js";
 import {
   loadConnectors
 } from "./chunk-WVVMH6FJ.js";
@@ -38,7 +39,7 @@ import {
   parseConnectionInfoFromDSN,
   splitSQLStatements,
   stripCommentsAndStrings
-} from "./chunk-JEZZN2YZ.js";
+} from "./chunk-MF6LSVWK.js";
 
 // src/server.ts
 import { McpServer, createMcpHandler } from "@modelcontextprotocol/server";
@@ -219,6 +220,17 @@ function normalizeSourceId(id) {
 function getEffectiveSourceId(sourceId) {
   return sourceId || "default";
 }
+function toStatementsPayload(resultSets) {
+  return resultSets.map((set) => ({
+    sql: set.sql,
+    rows: set.rows,
+    count: set.rowCount,
+    // Only present when a max_rows cap actually cut off rows, so consumers
+    // can tell a capped result from a table with exactly max_rows rows
+    // (and complete results don't pay the extra tokens).
+    ...set.truncated ? { truncated: true } : {}
+  }));
+}
 function resolveTrackedToolName(sourceId, baseName) {
   const isSingleSource = ConnectorManager.getAvailableSourceIds().length === 1;
   if (isSingleSource) {
@@ -288,8 +300,7 @@ function createExecuteSqlToolHandler(sourceId) {
       };
       result = await connector.executeSQL(sql, executeOptions);
       const responseData = {
-        rows: result.rows,
-        count: result.rowCount,
+        statements: toStatementsPayload(result.resultSets),
         source_id: effectiveSourceId,
         ...result.messages && result.messages.length > 0 ? { messages: result.messages } : {}
       };
@@ -348,8 +359,9 @@ async function getTableRowCount(connector, tableName, schemaName) {
     const qualifiedTable = quoteQualifiedIdentifier(tableName, schemaName, connector.id);
     const countQuery = `SELECT COUNT(*) as count FROM ${qualifiedTable}`;
     const result = await connector.executeSQL(countQuery, { maxRows: 1, readonly: true });
-    if (result.rows && result.rows.length > 0) {
-      return Number(result.rows[0].count || result.rows[0].COUNT || 0);
+    const rows = result.resultSets[0]?.rows;
+    if (rows && rows.length > 0) {
+      return Number(rows[0].count || rows[0].COUNT || 0);
     }
   } catch (error) {
     return null;
@@ -852,8 +864,8 @@ function createExplainSqlToolHandler(sourceId) {
       const explainStatement = buildExplainStatement(connector.id, sql);
       result = await connector.executeSQL(explainStatement, { readonly: true });
       const responseData = {
-        rows: result.rows,
-        count: result.rowCount,
+        rows: result.resultSets[0].rows,
+        count: result.resultSets[0].rowCount,
         source_id: effectiveSourceId,
         ...result.messages && result.messages.length > 0 ? { messages: result.messages } : {}
       };
@@ -1000,7 +1012,7 @@ function getExecuteSqlMetadata(sourceId) {
     maxRows: toolConfig?.max_rows
   };
   const readonlyNote = executeOptions.readonly ? " [READ-ONLY MODE]" : "";
-  const maxRowsNote = executeOptions.maxRows ? ` (limited to ${executeOptions.maxRows} rows)` : "";
+  const maxRowsNote = executeOptions.maxRows ? ` (limited to ${executeOptions.maxRows} rows; capped results carry "truncated": true)` : "";
   const description = isSingleSource ? `${userDescPrefix}Execute SQL queries on the ${dbType} database${readonlyNote}${maxRowsNote}` : `${userDescPrefix}Execute SQL queries on the '${sourceId}' ${dbType} database${readonlyNote}${maxRowsNote}`;
   const isReadonly = isReadOnlyPolicy(policyFromReadonly(executeOptions.readonly));
   const annotations = {
@@ -1036,7 +1048,7 @@ function getExplainSqlMetadata(sourceId) {
     "explain_sql",
     "Explain Query Plan"
   );
-  const description = isSingleSource ? `${userDescPrefix}Show the execution plan for a SQL statement on the ${dbType} database without running it. Always read-only and safe, independent of the source's read/write mode.` : `${userDescPrefix}Show the execution plan for a SQL statement on the '${sourceId}' ${dbType} database without running it. Always read-only and safe, independent of the source's read/write mode.`;
+  const description = isSingleSource ? `${userDescPrefix}Show the execution plan for a SQL statement on the ${dbType} database without running it (always read-only).` : `${userDescPrefix}Show the execution plan for a SQL statement on the '${sourceId}' ${dbType} database without running it (always read-only).`;
   const annotations = {
     title,
     readOnlyHint: true,
@@ -1057,7 +1069,7 @@ function getHealthCheckMetadata(sourceId) {
     "health_check",
     "Health Check"
   );
-  const description = isSingleSource ? `${userDescPrefix}Report operational health metrics (connection pool state, buffer cache hit ratio) for the ${dbType} database. Read-only, independent of the source's read/write mode.` : `${userDescPrefix}Report operational health metrics (connection pool state, buffer cache hit ratio) for the '${sourceId}' ${dbType} database. Read-only, independent of the source's read/write mode.`;
+  const description = isSingleSource ? `${userDescPrefix}Report connection pool and buffer cache health metrics for the ${dbType} database (read-only).` : `${userDescPrefix}Report connection pool and buffer cache health metrics for the '${sourceId}' ${dbType} database (read-only).`;
   const annotations = {
     title,
     readOnlyHint: true,
@@ -1107,13 +1119,13 @@ function buildSearchObjectsTool(sourceId) {
         name: "object_type",
         type: "string",
         required: true,
-        description: "Object type to search: schema, table, view, column, procedure, function, index"
+        description: "Object type to search"
       },
       {
         name: "pattern",
         type: "string",
         required: false,
-        description: "LIKE pattern (% = any chars, _ = one char). Default: %"
+        description: "LIKE pattern (% = any chars, _ = one char)"
       },
       {
         name: "schema",
@@ -1137,7 +1149,7 @@ function buildSearchObjectsTool(sourceId) {
         name: "limit",
         type: "integer",
         required: false,
-        description: "Max results (default: 100, max: 1000)"
+        description: "Max results"
       }
     ],
     readonly: true
@@ -1267,8 +1279,7 @@ function createCustomToolHandler(toolConfig) {
         paramValues
       );
       const responseData = {
-        rows: result.rows,
-        count: result.rowCount,
+        statements: toStatementsPayload(result.resultSets),
         source_id: toolConfig.source
       };
       return createToolSuccessResponse(responseData);
@@ -1822,6 +1833,32 @@ function validateOrigin(originHeader, hostHeader, allowedHosts) {
   return { ok: true };
 }
 
+// src/utils/auth-token.ts
+import { timingSafeEqual } from "node:crypto";
+var BEARER_PREFIX = "Bearer ";
+function constantTimeEqual(a, b) {
+  const bufA = Buffer.from(a);
+  const bufB = Buffer.from(b);
+  if (bufA.length !== bufB.length) return false;
+  return timingSafeEqual(bufA, bufB);
+}
+function validateAuthToken(authorizationHeader, tokens) {
+  if (tokens.length === 0) return { ok: true };
+  if (!authorizationHeader || !authorizationHeader.startsWith(BEARER_PREFIX)) {
+    return {
+      ok: false,
+      status: 401,
+      message: "Missing or malformed Authorization header. Expected: Bearer <token>"
+    };
+  }
+  const presented = authorizationHeader.slice(BEARER_PREFIX.length);
+  const matches = tokens.some((token) => constantTimeEqual(presented, token));
+  if (!matches) {
+    return { ok: false, status: 401, message: "Invalid bearer token" };
+  }
+  return { ok: true };
+}
+
 // src/server.ts
 var __filename = fileURLToPath(import.meta.url);
 var __dirname = path.dirname(__filename);
@@ -1876,7 +1913,7 @@ See documentation for more details on configuring database connections.
     const sources = sourceConfigsData.sources;
     console.error(`Configuration source: ${sourceConfigsData.source}`);
     await connectorManager.connectWithSources(sources);
-    const { initializeToolRegistry: initializeToolRegistry2 } = await import("./registry-JYRRNC3E.js");
+    const { initializeToolRegistry: initializeToolRegistry2 } = await import("./registry-D2QVU6AG.js");
     initializeToolRegistry2({
       sources: sourceConfigsData.sources,
       tools: sourceConfigsData.tools
@@ -1906,6 +1943,7 @@ See documentation for more details on configuring database connections.
     const port = transportData.type === "http" ? resolvePort().port : null;
     const host = transportData.type === "http" ? resolveHost().host : null;
     const allowedHosts = transportData.type === "http" ? buildAllowedHosts(resolveAllowedHosts().hosts, host ?? void 0, getSelfHosts()) : /* @__PURE__ */ new Set();
+    const { tokens: authTokens, source: authTokenSource } = resolveAuthTokens();
     const activeModes = [];
     const modeDescriptions = [];
     const isDemo = isDemoMode();
@@ -1940,18 +1978,26 @@ See documentation for more details on configuring database connections.
         }
         res.header("Access-Control-Allow-Origin", origin || "http://localhost");
         res.header("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
-        res.header("Access-Control-Allow-Headers", "Content-Type, Mcp-Session-Id, MCP-Protocol-Version, Mcp-Method, Mcp-Name");
+        res.header("Access-Control-Allow-Headers", "Content-Type, Authorization, Mcp-Session-Id, MCP-Protocol-Version, Mcp-Method, Mcp-Name");
         res.header("Access-Control-Allow-Credentials", "true");
         if (req.method === "OPTIONS") {
           return res.sendStatus(200);
         }
         next();
       });
-      const frontendPath = path.join(__dirname, "public");
-      app.use(express.static(frontendPath));
       app.get("/healthz", (req, res) => {
         res.status(200).send("OK");
       });
+      app.use((req, res, next) => {
+        const result = validateAuthToken(req.headers.authorization, authTokens);
+        if (!result.ok) {
+          res.header("WWW-Authenticate", "Bearer");
+          return res.status(result.status).json({ error: "Unauthorized", message: result.message });
+        }
+        next();
+      });
+      const frontendPath = path.join(__dirname, "public");
+      app.use(express.static(frontendPath));
       app.get("/api/sources", listSources);
       app.get("/api/sources/:sourceId", getSource);
       app.get("/api/requests", listRequests);
@@ -1983,6 +2029,11 @@ See documentation for more details on configuring database connections.
         } else {
           console.error(`Allowed hosts: ${[...allowedHosts].join(", ")} (set --allowed-hosts to serve other hostnames)`);
         }
+        if (authTokens.length > 0) {
+          console.error(`Auth: bearer token required (${authTokens.length} token(s) configured via ${authTokenSource})`);
+        } else {
+          console.error("Auth: disabled (set --auth-token or DBHUB_AUTH_TOKEN to require a bearer token)");
+        }
         if (process.env.NODE_ENV === "development") {
           console.error("Development mode detected!");
           console.error("   Workbench dev server (with HMR): http://localhost:5173");
@@ -2017,11 +2068,11 @@ See documentation for more details on configuring database connections.
 
 // src/index.ts
 var connectorModules = [
-  { load: () => import("./postgres-5ZOFYV6X.js"), name: "PostgreSQL", driver: "pg" },
-  { load: () => import("./sqlserver-PSAZRH7G.js"), name: "SQL Server", driver: "mssql" },
-  { load: () => import("./sqlite-5M7SDAQZ.js"), name: "SQLite", driver: "node:sqlite" },
-  { load: () => import("./mysql-265M3KBD.js"), name: "MySQL", driver: "mysql2" },
-  { load: () => import("./mariadb-DUDFBY5W.js"), name: "MariaDB", driver: "mariadb" }
+  { load: () => import("./postgres-2FHS64EO.js"), name: "PostgreSQL", driver: "pg" },
+  { load: () => import("./sqlserver-WNVSBFJ3.js"), name: "SQL Server", driver: "mssql" },
+  { load: () => import("./sqlite-ASYMU5BI.js"), name: "SQLite", driver: "node:sqlite" },
+  { load: () => import("./mysql-GXDUNLJ6.js"), name: "MySQL", driver: "mysql2" },
+  { load: () => import("./mariadb-DQ6P57IX.js"), name: "MariaDB", driver: "mariadb" }
 ];
 loadConnectors(connectorModules).then(() => main()).catch((error) => {
   console.error("Fatal error:", error);

package/dist/{mariadb-DUDFBY5W.js → mariadb-DQ6P57IX.js}

@@ -1,12 +1,11 @@
 import {
   MissingDatabaseError,
-  extractAffectedRows,
   getMySQLFamilyHealthCheck,
   isTiDBVersion,
-  parseQueryResults,
+  parseQueryResultSets,
   requireDatabaseInDSN,
   withReadOnlyTransaction
-} from "./chunk-NIILHXTG.js";
+} from "./chunk-A4TSDCPY.js";
 import "./chunk-FU2ZJE4E.js";
 import {
   quoteIdentifier
@@ -14,13 +13,13 @@ import {
 import {
   SQLRowLimiter,
   closeQuietly
-} from "./chunk-S2V6RZ3C.js";
+} from "./chunk-6QETXS44.js";
 import {
   ConnectorRegistry,
   SafeURL,
   obfuscateDSNPassword,
   splitSQLStatements
-} from "./chunk-JEZZN2YZ.js";
+} from "./chunk-MF6LSVWK.js";
 
 // src/connectors/mariadb/index.ts
 import * as mariadb from "mariadb";
@@ -505,13 +504,15 @@ var MariaDBConnector = class _MariaDBConnector {
         options.readonly,
         this.supportsReadOnlyTransaction,
         async () => {
+          const statements = splitSQLStatements(sql, "mariadb");
           let processedSQL = sql;
+          let probes = [];
           if (options.maxRows) {
-            const statements = splitSQLStatements(sql, "mariadb");
-            const processedStatements = statements.map(
-              (statement) => SQLRowLimiter.applyMaxRows(statement, options.maxRows)
+            const rewrites = statements.map(
+              (statement) => SQLRowLimiter.applyMaxRowsWithTruncationProbe(statement, options.maxRows)
             );
-            processedSQL = processedStatements.join("; ");
+            probes = rewrites.map((rewrite) => rewrite.probeApplied);
+            processedSQL = rewrites.map((rewrite) => rewrite.sql).join("; ");
             if (sql.trim().endsWith(";")) {
               processedSQL += ";";
             }
@@ -522,9 +523,13 @@ var MariaDBConnector = class _MariaDBConnector {
           } else {
             results = await conn.query(processedSQL);
           }
-          const rows = parseQueryResults(results);
-          const rowCount = extractAffectedRows(results);
-          return { rows, rowCount };
+          const resultSets = parseQueryResultSets(results, statements);
+          if (resultSets.length === probes.length) {
+            resultSets.forEach(
+              (set, index) => SQLRowLimiter.flagTruncation(set, options.maxRows, probes[index])
+            );
+          }
+          return { resultSets };
         }
       );
     } finally {

package/dist/{mysql-265M3KBD.js → mysql-GXDUNLJ6.js}

@@ -1,12 +1,12 @@
 import {
   MissingDatabaseError,
-  extractAffectedRows,
   getMySQLFamilyHealthCheck,
+  isClientSideTimeout,
   isTiDBVersion,
-  parseQueryResults,
+  parseQueryResultSets,
   requireDatabaseInDSN,
   withReadOnlyTransaction
-} from "./chunk-NIILHXTG.js";
+} from "./chunk-A4TSDCPY.js";
 import "./chunk-FU2ZJE4E.js";
 import {
   quoteIdentifier
@@ -14,13 +14,13 @@ import {
 import {
   SQLRowLimiter,
   closeQuietly
-} from "./chunk-S2V6RZ3C.js";
+} from "./chunk-6QETXS44.js";
 import {
   ConnectorRegistry,
   SafeURL,
   obfuscateDSNPassword,
   splitSQLStatements
-} from "./chunk-JEZZN2YZ.js";
+} from "./chunk-MF6LSVWK.js";
 
 // src/connectors/mysql/index.ts
 import mysql from "mysql2/promise";
@@ -106,7 +106,7 @@ Expected: ${expectedFormat}`
     }
   }
 };
-var MySQLConnector = class _MySQLConnector {
+var _MySQLConnector = class _MySQLConnector {
   constructor() {
     this.id = "mysql";
     this.name = "MySQL";
@@ -507,19 +507,23 @@ var MySQLConnector = class _MySQLConnector {
       throw new Error("Not connected to database");
     }
     const conn = await this.pool.getConnection();
+    const threadId = conn.threadId;
+    let isConnectionPoisoned = false;
     try {
       return await withReadOnlyTransaction(
         conn,
         options.readonly,
         this.supportsReadOnlyTransaction,
         async () => {
+          const statements = splitSQLStatements(sql, "mysql");
           let processedSQL = sql;
+          let probes = [];
           if (options.maxRows) {
-            const statements = splitSQLStatements(sql, "mysql");
-            const processedStatements = statements.map(
-              (statement) => SQLRowLimiter.applyMaxRows(statement, options.maxRows)
+            const rewrites = statements.map(
+              (statement) => SQLRowLimiter.applyMaxRowsWithTruncationProbe(statement, options.maxRows)
             );
-            processedSQL = processedStatements.join("; ");
+            probes = rewrites.map((rewrite) => rewrite.probeApplied);
+            processedSQL = rewrites.map((rewrite) => rewrite.sql).join("; ");
             if (sql.trim().endsWith(";")) {
               processedSQL += ";";
             }
@@ -531,16 +535,64 @@ var MySQLConnector = class _MySQLConnector {
             results = await conn.query({ sql: processedSQL, timeout: this.queryTimeoutMs });
           }
           const [firstResult] = results;
-          const rows = parseQueryResults(firstResult);
-          const rowCount = extractAffectedRows(firstResult);
-          return { rows, rowCount };
+          const resultSets = parseQueryResultSets(firstResult, statements);
+          if (resultSets.length === probes.length) {
+            resultSets.forEach(
+              (set, index) => SQLRowLimiter.flagTruncation(set, options.maxRows, probes[index])
+            );
+          }
+          return { resultSets };
         }
       );
+    } catch (error) {
+      if (isClientSideTimeout(error)) {
+        isConnectionPoisoned = true;
+        await this.killQuery(threadId);
+      }
+      throw error;
+    } finally {
+      if (isConnectionPoisoned) {
+        conn.destroy();
+      } else {
+        conn.release();
+      }
+    }
+  }
+  /**
+   * Best-effort server-side kill for a query abandoned by mysql2's client-side
+   * timeout. Uses a separate connection: the original connection's command
+   * queue is stuck behind the abandoned statement (see isClientSideTimeout)
+   * and cannot itself be used to send KILL QUERY.
+   *
+   * Bounded by its own short timeout, independent of the user's (possibly
+   * long or unset) query_timeout — KILL QUERY is metadata-only and should
+   * return almost immediately on a healthy server, so cleanup must not stall
+   * indefinitely if it doesn't.
+   */
+  async killQuery(threadId) {
+    if (!this.pool) return;
+    let killer;
+    let killerPoisoned = false;
+    try {
+      killer = await this.pool.getConnection();
+      await killer.query({ sql: `KILL QUERY ${threadId}`, timeout: _MySQLConnector.KILL_QUERY_TIMEOUT_MS });
+    } catch (error) {
+      killerPoisoned = isClientSideTimeout(error);
     } finally {
-      conn.release();
+      if (killer) {
+        if (killerPoisoned) {
+          killer.destroy();
+        } else {
+          killer.release();
+        }
+      }
     }
   }
 };
+// Bounds the KILL QUERY cleanup call issued after a client-side query
+// timeout; see killQuery.
+_MySQLConnector.KILL_QUERY_TIMEOUT_MS = 5e3;
+var MySQLConnector = _MySQLConnector;
 var mysqlConnector = new MySQLConnector();
 ConnectorRegistry.register(mysqlConnector);
 export {

package/dist/{postgres-5ZOFYV6X.js → postgres-2FHS64EO.js}

@@ -7,13 +7,13 @@ import {
 import {
   SQLRowLimiter,
   closeQuietly
-} from "./chunk-S2V6RZ3C.js";
+} from "./chunk-6QETXS44.js";
 import {
   ConnectorRegistry,
   SafeURL,
   obfuscateDSNPassword,
   splitSQLStatements
-} from "./chunk-JEZZN2YZ.js";
+} from "./chunk-MF6LSVWK.js";
 
 // src/connectors/postgres/index.ts
 import fs from "fs";
@@ -557,13 +557,22 @@ var PostgresConnector = class _PostgresConnector {
     try {
       const statements = splitSQLStatements(sql, "postgres");
       if (statements.length === 1) {
-        const processedStatement = SQLRowLimiter.applyMaxRows(statements[0], options.maxRows);
+        const { sql: processedStatement, probeApplied } = SQLRowLimiter.applyMaxRowsWithTruncationProbe(
+          statements[0],
+          options.maxRows
+        );
         if (options.readonly) {
           await client.query("BEGIN READ ONLY");
           try {
             const result2 = parameters && parameters.length > 0 ? await client.query(processedStatement, parameters) : await client.query(processedStatement);
             await client.query("COMMIT");
-            return { rows: result2.rows, rowCount: result2.rowCount ?? result2.rows.length };
+            const resultSet2 = {
+              sql: statements[0],
+              rows: result2.rows,
+              rowCount: result2.rowCount ?? result2.rows.length
+            };
+            SQLRowLimiter.flagTruncation(resultSet2, options.maxRows, probeApplied);
+            return { resultSets: [resultSet2] };
           } catch (error) {
             try {
               await client.query("ROLLBACK");
@@ -578,24 +587,33 @@ var PostgresConnector = class _PostgresConnector {
         } else {
           result = await client.query(processedStatement);
         }
-        return { rows: result.rows, rowCount: result.rowCount ?? result.rows.length };
+        const resultSet = {
+          sql: statements[0],
+          rows: result.rows,
+          rowCount: result.rowCount ?? result.rows.length
+        };
+        SQLRowLimiter.flagTruncation(resultSet, options.maxRows, probeApplied);
+        return { resultSets: [resultSet] };
       } else {
         if (parameters && parameters.length > 0) {
           throw new Error("Parameters are not supported for multi-statement queries in PostgreSQL");
         }
-        let allRows = [];
-        let totalRowCount = 0;
+        const resultSets = [];
         await client.query(options.readonly ? "BEGIN READ ONLY" : "BEGIN");
         try {
           for (let statement of statements) {
-            const processedStatement = SQLRowLimiter.applyMaxRows(statement, options.maxRows);
+            const { sql: processedStatement, probeApplied } = SQLRowLimiter.applyMaxRowsWithTruncationProbe(
+              statement,
+              options.maxRows
+            );
             const result = await client.query(processedStatement);
-            if (result.rows && result.rows.length > 0) {
-              allRows.push(...result.rows);
-            }
-            if (result.rowCount) {
-              totalRowCount += result.rowCount;
-            }
+            const resultSet = {
+              sql: statement,
+              rows: result.rows ?? [],
+              rowCount: result.rowCount ?? result.rows?.length ?? 0
+            };
+            SQLRowLimiter.flagTruncation(resultSet, options.maxRows, probeApplied);
+            resultSets.push(resultSet);
           }
           await client.query("COMMIT");
         } catch (error) {
@@ -605,7 +623,7 @@ var PostgresConnector = class _PostgresConnector {
           }
           throw error;
         }
-        return { rows: allRows, rowCount: totalRowCount };
+        return { resultSets };
       }
     } finally {
       client.release();