@bytebase/dbhub 1.4.0 → 1.5.0

package/dist/{postgres-DC5BDEMU.js → postgres-KCFNDQLG.js}

@@ -1,3 +1,8 @@
+import {
+  CANCEL_QUERY_TIMEOUT_MS,
+  clientQueryTimeoutMs,
+  isClientSideTimeout
+} from "./chunk-5XSBOK3W.js";
 import {
   toNullableNumber
 } from "./chunk-FU2ZJE4E.js";
@@ -7,8 +12,8 @@ import {
 import {
   SQLRowLimiter,
   closeQuietly
-} from "./chunk-YIGJHEU6.js";
-import "./chunk-ABTVMHD6.js";
+} from "./chunk-X5OCFRNL.js";
+import "./chunk-55X2VY5D.js";
 import {
   ConnectorRegistry,
   SafeURL,
@@ -17,10 +22,7 @@ import {
 } from "./chunk-IXC4NQGC.js";
 
 // src/connectors/postgres/index.ts
-import fs from "fs";
-import os from "os";
-import path from "path";
-import pg2 from "pg";
+import pg3 from "pg";
 
 // src/connectors/postgres/failed-to-read-certificate.ts
 var FailedToReadCertificate = class extends Error {
@@ -56,24 +58,83 @@ var postgresTypeParsers = {
   }
 };
 
-// src/connectors/postgres/index.ts
-var { Pool } = pg2;
-var POSTGRES_CLIENT_QUERY_TIMEOUT_GRACE_MS = 5e3;
+// src/connectors/postgres/ssl-pems.ts
+import fs from "fs";
+import os from "os";
+import path from "path";
+import pg2 from "pg";
 var CLIENT_CERT_SSL_MODES = ["require", "verify-ca", "verify-full"];
 var SUPPORTED_SSL_MODES = ["disable", ...CLIENT_CERT_SSL_MODES];
+var SSL_ROOT_CERT_LABEL = "SSL root certificate";
+var SSL_CLIENT_CERT_LABEL = "SSL client certificate";
+var SSL_CLIENT_KEY_LABEL = "SSL client key";
+function resolvePemPath(filePath) {
+  return filePath.startsWith("~/") ? path.join(os.homedir(), filePath.slice(2)) : filePath;
+}
+function failedToRead(label, resolved, err) {
+  return new FailedToReadCertificate(
+    `Failed to read ${label} at '${resolved}': ${err instanceof Error ? err.message : String(err)}`
+  );
+}
 async function readPemFile(filePath, label) {
-  const resolved = filePath.startsWith("~/") ? path.join(os.homedir(), filePath.slice(2)) : filePath;
+  const resolved = resolvePemPath(filePath);
   try {
     return await fs.promises.readFile(resolved, "utf-8");
   } catch (err) {
-    throw new FailedToReadCertificate(
-      `Failed to read ${label} at '${resolved}': ${err instanceof Error ? err.message : String(err)}`
-    );
+    throw failedToRead(label, resolved, err);
+  }
+}
+function readPemFileSync(filePath, label) {
+  const resolved = resolvePemPath(filePath);
+  try {
+    return fs.readFileSync(resolved, "utf-8");
+  } catch (err) {
+    throw failedToRead(label, resolved, err);
   }
 }
 function isEncryptedPemKey(pem) {
   return pem.includes("ENCRYPTED PRIVATE KEY") || pem.includes("Proc-Type: 4,ENCRYPTED");
 }
+function encryptedKeyMessage(keyPath) {
+  return `SSL client key at '${keyPath}' is encrypted; encrypted private keys are not supported. Decrypt it first, e.g. 'openssl pkey -in client.key -out client-plain.key'`;
+}
+function loadPems(paths) {
+  const pems = {};
+  if (paths.sslrootcert !== void 0) {
+    pems.ca = readPemFileSync(paths.sslrootcert, SSL_ROOT_CERT_LABEL);
+  }
+  if (paths.sslcert !== void 0 && paths.sslkey !== void 0) {
+    const key = readPemFileSync(paths.sslkey, SSL_CLIENT_KEY_LABEL);
+    if (isEncryptedPemKey(key)) {
+      throw new FailedToReadCertificate(encryptedKeyMessage(paths.sslkey));
+    }
+    pems.key = key;
+    pems.cert = readPemFileSync(paths.sslcert, SSL_CLIENT_CERT_LABEL);
+  }
+  return pems;
+}
+function rotatingPemClient(paths) {
+  return class RotatingPemClient extends pg2.Client {
+    connect(callback) {
+      let pems;
+      try {
+        pems = loadPems(paths);
+      } catch (err) {
+        const error = err instanceof Error ? err : new Error(String(err));
+        if (callback) {
+          callback(error);
+          return;
+        }
+        return Promise.reject(error);
+      }
+      Object.assign(this.ssl, pems);
+      return callback ? super.connect(callback) : super.connect();
+    }
+  };
+}
+
+// src/connectors/postgres/index.ts
+var { Pool } = pg3;
 var PostgresDSNParser = class {
   async parse(dsn, config) {
     const connectionTimeoutSeconds = config?.connectionTimeoutSeconds;
@@ -96,7 +157,7 @@ Expected: ${expectedFormat}`
         database: url.pathname ? url.pathname.substring(1) : "",
         // Remove leading '/' if exists
         user: url.username,
-        password: url.password
+        password: config?.password ?? url.password
       };
       let sslmode;
       let sslrootcert;
@@ -143,29 +204,30 @@ Expected: ${expectedFormat}`
           sslConfig.checkServerIdentity = () => void 0;
         }
         if (sslrootcert) {
-          sslConfig.ca = await readPemFile(sslrootcert, "SSL root certificate");
+          sslConfig.ca = await readPemFile(sslrootcert, SSL_ROOT_CERT_LABEL);
         }
         poolConfig.ssl = sslConfig;
       }
       if (sslcert !== void 0 && sslkey !== void 0) {
-        const key = await readPemFile(sslkey, "SSL client key");
+        const key = await readPemFile(sslkey, SSL_CLIENT_KEY_LABEL);
         if (isEncryptedPemKey(key)) {
-          throw new FailedToReadCertificate(
-            `SSL client key at '${sslkey}' is encrypted; encrypted private keys are not supported. Decrypt it first, e.g. 'openssl pkey -in client.key -out client-plain.key'`
-          );
+          throw new FailedToReadCertificate(encryptedKeyMessage(sslkey));
         }
         Object.assign(poolConfig.ssl, {
-          cert: await readPemFile(sslcert, "SSL client certificate"),
+          cert: await readPemFile(sslcert, SSL_CLIENT_CERT_LABEL),
           key
         });
       }
+      if (sslrootcert !== void 0 || sslcert !== void 0) {
+        poolConfig.Client = rotatingPemClient({ sslrootcert, sslcert, sslkey });
+      }
       if (connectionTimeoutSeconds !== void 0) {
         poolConfig.connectionTimeoutMillis = connectionTimeoutSeconds * 1e3;
       }
       if (queryTimeoutSeconds !== void 0) {
         const queryTimeoutMs = queryTimeoutSeconds * 1e3;
         poolConfig.statement_timeout = queryTimeoutMs;
-        poolConfig.query_timeout = queryTimeoutMs + POSTGRES_CLIENT_QUERY_TIMEOUT_GRACE_MS;
+        poolConfig.query_timeout = clientQueryTimeoutMs(queryTimeoutMs);
       }
       if (poolMaxConnections !== void 0) {
         poolConfig.max = poolMaxConnections;
@@ -639,6 +701,8 @@ var PostgresConnector = class _PostgresConnector {
       throw new Error("Not connected to database");
     }
     const client = await this.pool.connect();
+    const backendPid = client.processID;
+    let isClientDiscarded = false;
     try {
       const statements = splitSQLStatements(sql, "postgres");
       if (statements.length === 1) {
@@ -660,10 +724,7 @@ var PostgresConnector = class _PostgresConnector {
             SQLRowLimiter.flagTruncation(resultSet2, options.maxRows, probeApplied);
             return { resultSets: [resultSet2] };
           } catch (error) {
-            try {
-              await client.query("ROLLBACK");
-            } catch {
-            }
+            await this.rollbackQuietly(client, error);
             throw error;
           }
         }
@@ -704,16 +765,61 @@ var PostgresConnector = class _PostgresConnector {
           }
           await client.query("COMMIT");
         } catch (error) {
-          try {
-            await client.query("ROLLBACK");
-          } catch {
-          }
+          await this.rollbackQuietly(client, error);
           throw error;
         }
         return { resultSets };
       }
+    } catch (error) {
+      if (isClientSideTimeout(error)) {
+        isClientDiscarded = true;
+        client.release(true);
+        await this.cancelBackend(backendPid);
+      }
+      throw error;
     } finally {
-      client.release();
+      if (!isClientDiscarded) {
+        client.release();
+      }
+    }
+  }
+  /**
+   * Best-effort rollback after a failed statement, so a failed ROLLBACK (e.g.
+   * a dropped connection) cannot mask the original error. Skipped for a
+   * client-side timeout: the client is still busy with the abandoned
+   * statement, so the ROLLBACK would queue behind it (see isClientSideTimeout).
+   * executeSQL discards that client instead.
+   */
+  async rollbackQuietly(client, error) {
+    if (isClientSideTimeout(error)) {
+      return;
+    }
+    try {
+      await client.query("ROLLBACK");
+    } catch {
+    }
+  }
+  /**
+   * Best-effort server-side cancel for a statement abandoned by the
+   * client-side timeout, sent over a separate pooled connection. Closing the
+   * abandoned client's socket is not enough: PostgreSQL only notices a
+   * vanished client when it next writes to it, so a statement that is
+   * sleeping or computing would run to completion.
+   *
+   * Bounded by its own short timeout (CANCEL_QUERY_TIMEOUT_MS), independent
+   * of the user's query_timeout. pool.query discards its client on error, so
+   * a cancel that itself times out does not leak a stuck client.
+   */
+  async cancelBackend(backendPid) {
+    if (!this.pool || backendPid === null) return;
+    try {
+      const cancel = {
+        text: "SELECT pg_cancel_backend($1)",
+        values: [backendPid],
+        query_timeout: CANCEL_QUERY_TIMEOUT_MS
+      };
+      await this.pool.query(cancel);
+    } catch {
     }
   }
 };

package/dist/{registry-C7X5G7PA.js → registry-ZIVIYCB2.js}

@@ -2,8 +2,9 @@ import {
   ToolRegistry,
   getToolRegistry,
   initializeToolRegistry
-} from "./chunk-MJVIE3QY.js";
+} from "./chunk-PDKPK25P.js";
 import "./chunk-WVVMH6FJ.js";
+import "./chunk-5XSBOK3W.js";
 import "./chunk-IXC4NQGC.js";
 export {
   ToolRegistry,

package/dist/{sqlite-AO2BKIC6.js → sqlite-WKY6543Q.js}

@@ -4,8 +4,8 @@ import {
 import {
   SQLRowLimiter,
   closeQuietly
-} from "./chunk-YIGJHEU6.js";
-import "./chunk-ABTVMHD6.js";
+} from "./chunk-X5OCFRNL.js";
+import "./chunk-55X2VY5D.js";
 import {
   ConnectorRegistry,
   SafeURL,