@bytebase/dbhub 1.3.1 → 1.4.0

package/dist/{chunk-5FL4XMWG.js → chunk-MJVIE3QY.js}

@@ -1206,6 +1206,30 @@ function getRawDSNQueryParam(dsn, key) {
   }
   return null;
 }
+var CLIENT_CERT_SSL_MODES = ["require", "verify-ca", "verify-full"];
+function validateReadableFile(source, field, filePath, configPath) {
+  const expandedPath = expandHomeDir(filePath);
+  let stats;
+  try {
+    stats = fs2.statSync(expandedPath);
+  } catch {
+    throw new Error(
+      `Configuration file ${configPath}: source '${source.id}' ${field} file not found or not accessible: '${expandedPath}'`
+    );
+  }
+  if (!stats.isFile()) {
+    throw new Error(
+      `Configuration file ${configPath}: source '${source.id}' ${field} path is not a regular file: '${expandedPath}'`
+    );
+  }
+  try {
+    fs2.accessSync(expandedPath, fs2.constants.R_OK);
+  } catch {
+    throw new Error(
+      `Configuration file ${configPath}: source '${source.id}' ${field} file is not readable: '${expandedPath}'`
+    );
+  }
+}
 function validateDSNFieldConflicts(source, configPath) {
   const conflict = (field, fieldValue, dsnValue) => {
     throw new Error(
@@ -1262,6 +1286,13 @@ function validateDSNFieldConflicts(source, configPath) {
   if (source.sslrootcert && dsnSslrootcert !== null && expandHomeDir(source.sslrootcert) !== expandHomeDir(dsnSslrootcert)) {
     conflict("sslrootcert", expandHomeDir(source.sslrootcert), expandHomeDir(dsnSslrootcert));
   }
+  for (const field of ["sslcert", "sslkey"]) {
+    const fieldValue = source[field];
+    const dsnValue = getRawDSNQueryParam(source.dsn, field);
+    if (fieldValue && dsnValue !== null && expandHomeDir(fieldValue) !== expandHomeDir(dsnValue)) {
+      conflict(field, expandHomeDir(fieldValue), expandHomeDir(dsnValue));
+    }
+  }
   const dsnInstanceName = getRawDSNQueryParam(source.dsn, "instanceName");
   if (source.instanceName && dsnInstanceName !== null && dsnInstanceName !== source.instanceName) {
     conflict("instanceName", source.instanceName, dsnInstanceName);
@@ -1400,27 +1431,26 @@ function validateSourceConfig(source, configPath) {
         `Configuration file ${configPath}: source '${source.id}' has sslrootcert but sslmode is '${source.sslmode ?? "not set"}'. sslrootcert requires sslmode 'verify-ca' or 'verify-full'`
       );
     }
-    const expandedPath = expandHomeDir(source.sslrootcert);
-    let stats;
-    try {
-      stats = fs2.statSync(expandedPath);
-    } catch {
+    validateReadableFile(source, "sslrootcert", source.sslrootcert, configPath);
+  }
+  if (source.sslcert !== void 0 || source.sslkey !== void 0) {
+    if (source.type !== "postgres") {
       throw new Error(
-        `Configuration file ${configPath}: source '${source.id}' sslrootcert file not found or not accessible: '${expandedPath}'`
+        `Configuration file ${configPath}: source '${source.id}' has sslcert/sslkey but they are only supported for PostgreSQL.`
       );
     }
-    if (!stats.isFile()) {
+    if (source.sslcert === void 0 || source.sslkey === void 0) {
       throw new Error(
-        `Configuration file ${configPath}: source '${source.id}' sslrootcert path is not a regular file: '${expandedPath}'`
+        `Configuration file ${configPath}: source '${source.id}' has ${source.sslcert !== void 0 ? "sslcert" : "sslkey"} without ${source.sslcert !== void 0 ? "sslkey" : "sslcert"}. sslcert and sslkey must be set together for client certificate authentication`
       );
     }
-    try {
-      fs2.accessSync(expandedPath, fs2.constants.R_OK);
-    } catch {
+    if (!CLIENT_CERT_SSL_MODES.includes(source.sslmode ?? "")) {
       throw new Error(
-        `Configuration file ${configPath}: source '${source.id}' sslrootcert file is not readable: '${expandedPath}'`
+        `Configuration file ${configPath}: source '${source.id}' has sslcert/sslkey but sslmode is '${source.sslmode ?? "not set"}'. sslcert/sslkey require sslmode 'require', 'verify-ca' or 'verify-full'`
       );
     }
+    validateReadableFile(source, "sslcert", source.sslcert, configPath);
+    validateReadableFile(source, "sslkey", source.sslkey, configPath);
   }
   if (source.authentication !== void 0) {
     if (source.type !== "sqlserver") {
@@ -1536,8 +1566,10 @@ function processSourceConfigs(sources, configPath) {
     if (processed.ssh_key) {
       processed.ssh_key = expandHomeDir(processed.ssh_key);
     }
-    if (processed.sslrootcert) {
-      processed.sslrootcert = expandHomeDir(processed.sslrootcert);
+    for (const field of ["sslrootcert", "sslcert", "sslkey"]) {
+      if (processed[field]) {
+        processed[field] = expandHomeDir(processed[field]);
+      }
     }
     if (processed.type === "sqlite" && processed.database) {
       processed.database = resolveSqliteDatabasePath(processed.database, configPath);
@@ -1570,9 +1602,11 @@ function processSourceConfigs(sources, configPath) {
         if (!processed.sslmode && dsnSslmode) {
           processed.sslmode = dsnSslmode;
         }
-        const dsnSslrootcert = url.getSearchParam("sslrootcert");
-        if (!processed.sslrootcert && dsnSslrootcert) {
-          processed.sslrootcert = dsnSslrootcert;
+        for (const field of ["sslrootcert", "sslcert", "sslkey"]) {
+          const dsnValue = url.getSearchParam(field);
+          if (!processed[field] && dsnValue) {
+            processed[field] = dsnValue;
+          }
         }
       } catch {
       }
@@ -1631,10 +1665,7 @@ function mergeSourceFieldsIntoDSN(dsn, source) {
   if (source.sslmode && !hasParam("sslmode")) {
     additions.push(`sslmode=${source.sslmode}`);
   }
-  if (source.sslrootcert && source.type === "postgres" && (source.sslmode === "verify-ca" || source.sslmode === "verify-full") && !hasParam("sslrootcert")) {
-    const expandedCertPath = expandHomeDir(source.sslrootcert);
-    additions.push(`sslrootcert=${encodeURIComponent(expandedCertPath)}`);
-  }
+  additions.push(...postgresSslFileParams(source).filter(({ key }) => !hasParam(key)).map(({ param }) => param));
   if (additions.length === 0) {
     return dsn;
   }
@@ -1648,6 +1679,23 @@ function mergeSourceFieldsIntoDSN(dsn, source) {
   }
   return `${dsn}${separator}${additions.join("&")}`;
 }
+function postgresSslFileParams(source) {
+  if (source.type !== "postgres") {
+    return [];
+  }
+  const params = [];
+  const push = (key) => {
+    params.push({ key, param: `${key}=${encodeURIComponent(expandHomeDir(source[key]))}` });
+  };
+  if (source.sslrootcert && (source.sslmode === "verify-ca" || source.sslmode === "verify-full")) {
+    push("sslrootcert");
+  }
+  if (source.sslcert && source.sslkey && CLIENT_CERT_SSL_MODES.includes(source.sslmode ?? "")) {
+    push("sslcert");
+    push("sslkey");
+  }
+  return params;
+}
 function buildDSNFromSource(source) {
   if (source.dsn) {
     return mergeSourceFieldsIntoDSN(source.dsn, source);
@@ -1700,10 +1748,7 @@ function buildDSNFromSource(source) {
   if (source.sslmode && source.type !== "sqlite") {
     queryParams.push(`sslmode=${source.sslmode}`);
   }
-  if (source.sslrootcert && source.type === "postgres" && (source.sslmode === "verify-ca" || source.sslmode === "verify-full")) {
-    const expandedCertPath = expandHomeDir(source.sslrootcert);
-    queryParams.push(`sslrootcert=${encodeURIComponent(expandedCertPath)}`);
-  }
+  queryParams.push(...postgresSslFileParams(source).map(({ param }) => param));
   if (queryParams.length > 0) {
     dsn += `?${queryParams.join("&")}`;
   }

package/dist/index.js

@@ -18,7 +18,7 @@ import {
   resolveSourceConfigs,
   resolveTomlConfigPath,
   resolveTransport
-} from "./chunk-5FL4XMWG.js";
+} from "./chunk-MJVIE3QY.js";
 import {
   loadConnectors
 } from "./chunk-WVVMH6FJ.js";
@@ -1913,7 +1913,7 @@ See documentation for more details on configuring database connections.
     const sources = sourceConfigsData.sources;
     console.error(`Configuration source: ${sourceConfigsData.source}`);
     await connectorManager.connectWithSources(sources);
-    const { initializeToolRegistry: initializeToolRegistry2 } = await import("./registry-ZTHDPLKP.js");
+    const { initializeToolRegistry: initializeToolRegistry2 } = await import("./registry-C7X5G7PA.js");
     initializeToolRegistry2({
       sources: sourceConfigsData.sources,
       tools: sourceConfigsData.tools
@@ -2068,7 +2068,7 @@ See documentation for more details on configuring database connections.
 
 // src/index.ts
 var connectorModules = [
-  { load: () => import("./postgres-6XJ7V4J4.js"), name: "PostgreSQL", driver: "pg" },
+  { load: () => import("./postgres-DC5BDEMU.js"), name: "PostgreSQL", driver: "pg" },
   { load: () => import("./sqlserver-AJUK6L55.js"), name: "SQL Server", driver: "mssql" },
   { load: () => import("./sqlite-AO2BKIC6.js"), name: "SQLite", driver: "node:sqlite" },
   { load: () => import("./mysql-XXIHWQGR.js"), name: "MySQL", driver: "mysql2" },

package/dist/{postgres-6XJ7V4J4.js → postgres-DC5BDEMU.js}

@@ -59,6 +59,21 @@ var postgresTypeParsers = {
 // src/connectors/postgres/index.ts
 var { Pool } = pg2;
 var POSTGRES_CLIENT_QUERY_TIMEOUT_GRACE_MS = 5e3;
+var CLIENT_CERT_SSL_MODES = ["require", "verify-ca", "verify-full"];
+var SUPPORTED_SSL_MODES = ["disable", ...CLIENT_CERT_SSL_MODES];
+async function readPemFile(filePath, label) {
+  const resolved = filePath.startsWith("~/") ? path.join(os.homedir(), filePath.slice(2)) : filePath;
+  try {
+    return await fs.promises.readFile(resolved, "utf-8");
+  } catch (err) {
+    throw new FailedToReadCertificate(
+      `Failed to read ${label} at '${resolved}': ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+}
+function isEncryptedPemKey(pem) {
+  return pem.includes("ENCRYPTED PRIVATE KEY") || pem.includes("Proc-Type: 4,ENCRYPTED");
+}
 var PostgresDSNParser = class {
   async parse(dsn, config) {
     const connectionTimeoutSeconds = config?.connectionTimeoutSeconds;
@@ -85,13 +100,39 @@ Expected: ${expectedFormat}`
       };
       let sslmode;
       let sslrootcert;
+      let sslcert;
+      let sslkey;
       url.forEachSearchParam((value, key) => {
         if (key === "sslmode") {
           sslmode = value;
         } else if (key === "sslrootcert") {
           sslrootcert = value;
+        } else if (key === "sslcert") {
+          sslcert = value;
+        } else if (key === "sslkey") {
+          sslkey = value;
         }
       });
+      if (sslmode !== void 0 && !SUPPORTED_SSL_MODES.includes(sslmode)) {
+        throw new Error(
+          `Unsupported sslmode '${sslmode}'. Valid values: ${SUPPORTED_SSL_MODES.join(", ")}`
+        );
+      }
+      if (sslrootcert !== void 0 && sslmode !== "verify-ca" && sslmode !== "verify-full") {
+        throw new FailedToReadCertificate(
+          `sslrootcert requires sslmode 'verify-ca' or 'verify-full' (got '${sslmode ?? "not set"}'). Use sslmode=verify-ca to verify the server certificate against it, or remove sslrootcert.`
+        );
+      }
+      if (sslcert === void 0 !== (sslkey === void 0)) {
+        throw new FailedToReadCertificate(
+          "sslcert and sslkey must be set together for client certificate authentication"
+        );
+      }
+      if (sslcert !== void 0 && !CLIENT_CERT_SSL_MODES.includes(sslmode ?? "")) {
+        throw new FailedToReadCertificate(
+          `sslcert/sslkey require sslmode to be one of ${CLIENT_CERT_SSL_MODES.join(", ")} (got '${sslmode ?? "not set"}')`
+        );
+      }
       if (sslmode === "disable") {
         poolConfig.ssl = false;
       } else if (sslmode === "require") {
@@ -102,18 +143,21 @@ Expected: ${expectedFormat}`
           sslConfig.checkServerIdentity = () => void 0;
         }
         if (sslrootcert) {
-          const certPath = sslrootcert.startsWith("~/") ? path.join(os.homedir(), sslrootcert.slice(2)) : sslrootcert;
-          try {
-            sslConfig.ca = await fs.promises.readFile(certPath, "utf-8");
-          } catch (err) {
-            throw new FailedToReadCertificate(
-              `Failed to read SSL root certificate at '${certPath}': ${err instanceof Error ? err.message : String(err)}`
-            );
-          }
+          sslConfig.ca = await readPemFile(sslrootcert, "SSL root certificate");
         }
         poolConfig.ssl = sslConfig;
-      } else if (sslmode !== void 0) {
-        poolConfig.ssl = true;
+      }
+      if (sslcert !== void 0 && sslkey !== void 0) {
+        const key = await readPemFile(sslkey, "SSL client key");
+        if (isEncryptedPemKey(key)) {
+          throw new FailedToReadCertificate(
+            `SSL client key at '${sslkey}' is encrypted; encrypted private keys are not supported. Decrypt it first, e.g. 'openssl pkey -in client.key -out client-plain.key'`
+          );
+        }
+        Object.assign(poolConfig.ssl, {
+          cert: await readPemFile(sslcert, "SSL client certificate"),
+          key
+        });
       }
       if (connectionTimeoutSeconds !== void 0) {
         poolConfig.connectionTimeoutMillis = connectionTimeoutSeconds * 1e3;

package/dist/{registry-ZTHDPLKP.js → registry-C7X5G7PA.js}

@@ -2,7 +2,7 @@ import {
   ToolRegistry,
   getToolRegistry,
   initializeToolRegistry
-} from "./chunk-5FL4XMWG.js";
+} from "./chunk-MJVIE3QY.js";
 import "./chunk-WVVMH6FJ.js";
 import "./chunk-IXC4NQGC.js";
 export {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bytebase/dbhub",
-  "version": "1.3.1",
+  "version": "1.4.0",
   "mcpName": "io.github.bytebase/dbhub",
   "description": "Token-efficient database MCP server for PostgreSQL, MySQL, MariaDB, SQL Server, Oracle, SQLite",
   "repository": {