@bytebase/dbhub 1.3.1 → 1.5.0

package/dist/{postgres-6XJ7V4J4.js → postgres-KCFNDQLG.js}

@@ -1,3 +1,8 @@
+import {
+  CANCEL_QUERY_TIMEOUT_MS,
+  clientQueryTimeoutMs,
+  isClientSideTimeout
+} from "./chunk-5XSBOK3W.js";
 import {
   toNullableNumber
 } from "./chunk-FU2ZJE4E.js";
@@ -7,8 +12,8 @@ import {
 import {
   SQLRowLimiter,
   closeQuietly
-} from "./chunk-YIGJHEU6.js";
-import "./chunk-ABTVMHD6.js";
+} from "./chunk-X5OCFRNL.js";
+import "./chunk-55X2VY5D.js";
 import {
   ConnectorRegistry,
   SafeURL,
@@ -17,10 +22,7 @@ import {
 } from "./chunk-IXC4NQGC.js";
 
 // src/connectors/postgres/index.ts
-import fs from "fs";
-import os from "os";
-import path from "path";
-import pg2 from "pg";
+import pg3 from "pg";
 
 // src/connectors/postgres/failed-to-read-certificate.ts
 var FailedToReadCertificate = class extends Error {
@@ -56,9 +58,83 @@ var postgresTypeParsers = {
   }
 };
 
+// src/connectors/postgres/ssl-pems.ts
+import fs from "fs";
+import os from "os";
+import path from "path";
+import pg2 from "pg";
+var CLIENT_CERT_SSL_MODES = ["require", "verify-ca", "verify-full"];
+var SUPPORTED_SSL_MODES = ["disable", ...CLIENT_CERT_SSL_MODES];
+var SSL_ROOT_CERT_LABEL = "SSL root certificate";
+var SSL_CLIENT_CERT_LABEL = "SSL client certificate";
+var SSL_CLIENT_KEY_LABEL = "SSL client key";
+function resolvePemPath(filePath) {
+  return filePath.startsWith("~/") ? path.join(os.homedir(), filePath.slice(2)) : filePath;
+}
+function failedToRead(label, resolved, err) {
+  return new FailedToReadCertificate(
+    `Failed to read ${label} at '${resolved}': ${err instanceof Error ? err.message : String(err)}`
+  );
+}
+async function readPemFile(filePath, label) {
+  const resolved = resolvePemPath(filePath);
+  try {
+    return await fs.promises.readFile(resolved, "utf-8");
+  } catch (err) {
+    throw failedToRead(label, resolved, err);
+  }
+}
+function readPemFileSync(filePath, label) {
+  const resolved = resolvePemPath(filePath);
+  try {
+    return fs.readFileSync(resolved, "utf-8");
+  } catch (err) {
+    throw failedToRead(label, resolved, err);
+  }
+}
+function isEncryptedPemKey(pem) {
+  return pem.includes("ENCRYPTED PRIVATE KEY") || pem.includes("Proc-Type: 4,ENCRYPTED");
+}
+function encryptedKeyMessage(keyPath) {
+  return `SSL client key at '${keyPath}' is encrypted; encrypted private keys are not supported. Decrypt it first, e.g. 'openssl pkey -in client.key -out client-plain.key'`;
+}
+function loadPems(paths) {
+  const pems = {};
+  if (paths.sslrootcert !== void 0) {
+    pems.ca = readPemFileSync(paths.sslrootcert, SSL_ROOT_CERT_LABEL);
+  }
+  if (paths.sslcert !== void 0 && paths.sslkey !== void 0) {
+    const key = readPemFileSync(paths.sslkey, SSL_CLIENT_KEY_LABEL);
+    if (isEncryptedPemKey(key)) {
+      throw new FailedToReadCertificate(encryptedKeyMessage(paths.sslkey));
+    }
+    pems.key = key;
+    pems.cert = readPemFileSync(paths.sslcert, SSL_CLIENT_CERT_LABEL);
+  }
+  return pems;
+}
+function rotatingPemClient(paths) {
+  return class RotatingPemClient extends pg2.Client {
+    connect(callback) {
+      let pems;
+      try {
+        pems = loadPems(paths);
+      } catch (err) {
+        const error = err instanceof Error ? err : new Error(String(err));
+        if (callback) {
+          callback(error);
+          return;
+        }
+        return Promise.reject(error);
+      }
+      Object.assign(this.ssl, pems);
+      return callback ? super.connect(callback) : super.connect();
+    }
+  };
+}
+
 // src/connectors/postgres/index.ts
-var { Pool } = pg2;
-var POSTGRES_CLIENT_QUERY_TIMEOUT_GRACE_MS = 5e3;
+var { Pool } = pg3;
 var PostgresDSNParser = class {
   async parse(dsn, config) {
     const connectionTimeoutSeconds = config?.connectionTimeoutSeconds;
@@ -81,17 +157,43 @@ Expected: ${expectedFormat}`
         database: url.pathname ? url.pathname.substring(1) : "",
         // Remove leading '/' if exists
         user: url.username,
-        password: url.password
+        password: config?.password ?? url.password
       };
       let sslmode;
       let sslrootcert;
+      let sslcert;
+      let sslkey;
       url.forEachSearchParam((value, key) => {
         if (key === "sslmode") {
           sslmode = value;
         } else if (key === "sslrootcert") {
           sslrootcert = value;
+        } else if (key === "sslcert") {
+          sslcert = value;
+        } else if (key === "sslkey") {
+          sslkey = value;
         }
       });
+      if (sslmode !== void 0 && !SUPPORTED_SSL_MODES.includes(sslmode)) {
+        throw new Error(
+          `Unsupported sslmode '${sslmode}'. Valid values: ${SUPPORTED_SSL_MODES.join(", ")}`
+        );
+      }
+      if (sslrootcert !== void 0 && sslmode !== "verify-ca" && sslmode !== "verify-full") {
+        throw new FailedToReadCertificate(
+          `sslrootcert requires sslmode 'verify-ca' or 'verify-full' (got '${sslmode ?? "not set"}'). Use sslmode=verify-ca to verify the server certificate against it, or remove sslrootcert.`
+        );
+      }
+      if (sslcert === void 0 !== (sslkey === void 0)) {
+        throw new FailedToReadCertificate(
+          "sslcert and sslkey must be set together for client certificate authentication"
+        );
+      }
+      if (sslcert !== void 0 && !CLIENT_CERT_SSL_MODES.includes(sslmode ?? "")) {
+        throw new FailedToReadCertificate(
+          `sslcert/sslkey require sslmode to be one of ${CLIENT_CERT_SSL_MODES.join(", ")} (got '${sslmode ?? "not set"}')`
+        );
+      }
       if (sslmode === "disable") {
         poolConfig.ssl = false;
       } else if (sslmode === "require") {
@@ -102,18 +204,22 @@ Expected: ${expectedFormat}`
           sslConfig.checkServerIdentity = () => void 0;
         }
         if (sslrootcert) {
-          const certPath = sslrootcert.startsWith("~/") ? path.join(os.homedir(), sslrootcert.slice(2)) : sslrootcert;
-          try {
-            sslConfig.ca = await fs.promises.readFile(certPath, "utf-8");
-          } catch (err) {
-            throw new FailedToReadCertificate(
-              `Failed to read SSL root certificate at '${certPath}': ${err instanceof Error ? err.message : String(err)}`
-            );
-          }
+          sslConfig.ca = await readPemFile(sslrootcert, SSL_ROOT_CERT_LABEL);
         }
         poolConfig.ssl = sslConfig;
-      } else if (sslmode !== void 0) {
-        poolConfig.ssl = true;
+      }
+      if (sslcert !== void 0 && sslkey !== void 0) {
+        const key = await readPemFile(sslkey, SSL_CLIENT_KEY_LABEL);
+        if (isEncryptedPemKey(key)) {
+          throw new FailedToReadCertificate(encryptedKeyMessage(sslkey));
+        }
+        Object.assign(poolConfig.ssl, {
+          cert: await readPemFile(sslcert, SSL_CLIENT_CERT_LABEL),
+          key
+        });
+      }
+      if (sslrootcert !== void 0 || sslcert !== void 0) {
+        poolConfig.Client = rotatingPemClient({ sslrootcert, sslcert, sslkey });
       }
       if (connectionTimeoutSeconds !== void 0) {
         poolConfig.connectionTimeoutMillis = connectionTimeoutSeconds * 1e3;
@@ -121,7 +227,7 @@ Expected: ${expectedFormat}`
       if (queryTimeoutSeconds !== void 0) {
         const queryTimeoutMs = queryTimeoutSeconds * 1e3;
         poolConfig.statement_timeout = queryTimeoutMs;
-        poolConfig.query_timeout = queryTimeoutMs + POSTGRES_CLIENT_QUERY_TIMEOUT_GRACE_MS;
+        poolConfig.query_timeout = clientQueryTimeoutMs(queryTimeoutMs);
       }
       if (poolMaxConnections !== void 0) {
         poolConfig.max = poolMaxConnections;
@@ -595,6 +701,8 @@ var PostgresConnector = class _PostgresConnector {
       throw new Error("Not connected to database");
     }
     const client = await this.pool.connect();
+    const backendPid = client.processID;
+    let isClientDiscarded = false;
     try {
       const statements = splitSQLStatements(sql, "postgres");
       if (statements.length === 1) {
@@ -616,10 +724,7 @@ var PostgresConnector = class _PostgresConnector {
             SQLRowLimiter.flagTruncation(resultSet2, options.maxRows, probeApplied);
             return { resultSets: [resultSet2] };
           } catch (error) {
-            try {
-              await client.query("ROLLBACK");
-            } catch {
-            }
+            await this.rollbackQuietly(client, error);
             throw error;
           }
         }
@@ -660,16 +765,61 @@ var PostgresConnector = class _PostgresConnector {
           }
           await client.query("COMMIT");
         } catch (error) {
-          try {
-            await client.query("ROLLBACK");
-          } catch {
-          }
+          await this.rollbackQuietly(client, error);
           throw error;
         }
         return { resultSets };
       }
+    } catch (error) {
+      if (isClientSideTimeout(error)) {
+        isClientDiscarded = true;
+        client.release(true);
+        await this.cancelBackend(backendPid);
+      }
+      throw error;
     } finally {
-      client.release();
+      if (!isClientDiscarded) {
+        client.release();
+      }
+    }
+  }
+  /**
+   * Best-effort rollback after a failed statement, so a failed ROLLBACK (e.g.
+   * a dropped connection) cannot mask the original error. Skipped for a
+   * client-side timeout: the client is still busy with the abandoned
+   * statement, so the ROLLBACK would queue behind it (see isClientSideTimeout).
+   * executeSQL discards that client instead.
+   */
+  async rollbackQuietly(client, error) {
+    if (isClientSideTimeout(error)) {
+      return;
+    }
+    try {
+      await client.query("ROLLBACK");
+    } catch {
+    }
+  }
+  /**
+   * Best-effort server-side cancel for a statement abandoned by the
+   * client-side timeout, sent over a separate pooled connection. Closing the
+   * abandoned client's socket is not enough: PostgreSQL only notices a
+   * vanished client when it next writes to it, so a statement that is
+   * sleeping or computing would run to completion.
+   *
+   * Bounded by its own short timeout (CANCEL_QUERY_TIMEOUT_MS), independent
+   * of the user's query_timeout. pool.query discards its client on error, so
+   * a cancel that itself times out does not leak a stuck client.
+   */
+  async cancelBackend(backendPid) {
+    if (!this.pool || backendPid === null) return;
+    try {
+      const cancel = {
+        text: "SELECT pg_cancel_backend($1)",
+        values: [backendPid],
+        query_timeout: CANCEL_QUERY_TIMEOUT_MS
+      };
+      await this.pool.query(cancel);
+    } catch {
     }
   }
 };

package/dist/{registry-ZTHDPLKP.js → registry-ZIVIYCB2.js}

@@ -2,8 +2,9 @@ import {
   ToolRegistry,
   getToolRegistry,
   initializeToolRegistry
-} from "./chunk-5FL4XMWG.js";
+} from "./chunk-PDKPK25P.js";
 import "./chunk-WVVMH6FJ.js";
+import "./chunk-5XSBOK3W.js";
 import "./chunk-IXC4NQGC.js";
 export {
   ToolRegistry,

package/dist/{sqlite-AO2BKIC6.js → sqlite-WKY6543Q.js}

@@ -4,8 +4,8 @@ import {
 import {
   SQLRowLimiter,
   closeQuietly
-} from "./chunk-YIGJHEU6.js";
-import "./chunk-ABTVMHD6.js";
+} from "./chunk-X5OCFRNL.js";
+import "./chunk-55X2VY5D.js";
 import {
   ConnectorRegistry,
   SafeURL,