@hedeqiang/dsh-nl2sql 0.14.1 → 0.14.2

package/CHANGELOG.md

@@ -5,6 +5,13 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.14.2] - 2026-11-13
+
+### Fixed
+- A column named just `token` was always masked, but in crypto / payment databases it is the currency (USDT, BTC…). It is now masked only in credential tables (sessions, oauth, api keys…) or when its comment says it is a credential; credential names such as `access_token`, `api_token` and `token_hash` are still masked. Mask any other column explicitly with the data source's access policy.
+- `tel`, `mail` and `mobile` no longer match inside other words (`whitelist_status`, `hotel`, `telegram_id`, `mailbox`).
+- Cached schema analyses are re-classified with the new rules on load (no re-analysis needed), and cached query results masked under the old rules are not reused.
+
 ## [0.14.1] - 2026-11-13
 
 ### Fixed
@@ -144,7 +151,8 @@ These features are tested with local databases and fake IM / Lark servers; real
 
 - Redesigned UI; Lark push (Markdown and native charts); access control, feedback loop, dashboard global filters; PostgreSQL / Elasticsearch, SSH tunnels, privacy settings, automatic overviews, scheduled reports; semantic layer, ER graph, scan guard, history and audit, dashboards; first version.
 
-[Unreleased]: https://github.com/hedeqiang/dsh-nl2sql/compare/v0.14.1...HEAD
+[Unreleased]: https://github.com/hedeqiang/dsh-nl2sql/compare/v0.14.2...HEAD
+[0.14.2]: https://github.com/hedeqiang/dsh-nl2sql/compare/v0.14.1...v0.14.2
 [0.14.1]: https://github.com/hedeqiang/dsh-nl2sql/compare/v0.14.0...v0.14.1
 [0.14.0]: https://github.com/hedeqiang/dsh-nl2sql/compare/v0.13.1...v0.14.0
 [0.13.1]: https://github.com/hedeqiang/dsh-nl2sql/compare/v0.13.0...v0.13.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hedeqiang/dsh-nl2sql",
-  "version": "0.14.1",
+  "version": "0.14.2",
   "description": "Ask MySQL, PostgreSQL, Elasticsearch and CSV/Excel in plain language inside DeepSeek Harness: charts, dashboards, alerts, and IM push and bots for Lark/Feishu, Telegram, WeCom and DingTalk.",
   "type": "module",
   "bin": {

package/service/query.js

@@ -9,7 +9,7 @@ import { admitSql, prepareSql, stripSql } from '../sql-guard.js'
 import { cacheKey } from '../store.js'
 import { createHash } from 'node:crypto'
 import { writeXlsx } from '../xlsx.js'
-import { RESULT_CACHE_LIMIT, SENSITIVE_NAME, UserError, callContext, columnKind, fillChartHint, fmtNum, maskValue, newId, normalizeChart, suggestChart, summarize } from './shared.js'
+import { RESULT_CACHE_LIMIT, SENSITIVE_NAME, SENSITIVE_RULES_VERSION, isCredentialToken, UserError, callContext, columnKind, fillChartHint, fmtNum, maskValue, newId, normalizeChart, suggestChart, summarize } from './shared.js'
 
 export const methods = {
   // ---------------------------------------------------------------- query
@@ -87,7 +87,7 @@ export const methods = {
     }
     // Query cache: dashboards, reruns and reports reuse a recent identical result.
     const ttlMs = (settings.cacheTtlSec ?? 0) * 1000
-    const key = ttlMs > 0 && useCache && this.store ? cacheKey([ds.id, admitted.sql, settings.maxRows, settings.maskSensitive, ds.policy ?? null, ds.updatedAt ?? 0, rowRules, rowRulesSig ?? null]) : null
+    const key = ttlMs > 0 && useCache && this.store ? cacheKey([ds.id, admitted.sql, settings.maxRows, settings.maskSensitive, SENSITIVE_RULES_VERSION, ds.policy ?? null, ds.updatedAt ?? 0, rowRules, rowRulesSig ?? null]) : null
     if (key) {
       const hit = this.store.cached(key, ttlMs)
       if (hit && (hit.rowRulesSig ?? undefined) === rowRulesSig) {
@@ -142,7 +142,7 @@ export const methods = {
     if (settings.maskSensitive) {
       res.columns.forEach((f, i) => {
         const col = f.table ? schema?.tables.find(t => t.name === f.table)?.columns.find(c => c.name === f.column) : undefined
-        if (col?.roles.includes('sensitive') || SENSITIVE_NAME.test(f.name)) sensitive.add(i)
+        if (col?.roles.includes('sensitive') || SENSITIVE_NAME.test(f.name) || (!col && isCredentialToken(f.name, f.table))) sensitive.add(i)
       })
     }
     for (const row of cells) for (const i of sensitive) row[i] = maskValue(res.columns[i].name, row[i])

package/service/schema.js

@@ -7,7 +7,7 @@ import { annotateSchema, columnMasked, filterSchema, normalizePolicy, policyActi
 import { admitSql } from '../sql-guard.js'
 import { readFile, writeFile } from 'node:fs/promises'
 import { join } from 'node:path'
-import { DIALECT_HINTS, UserError, classifyColumn, classifyTable, inferRelations, maskValue, newId, requireText, singular, upsert } from './shared.js'
+import { DIALECT_HINTS, SENSITIVE_RULES_VERSION, UserError, classifyColumn, classifyTable, inferRelations, maskValue, newId, requireText, singular, upsert } from './shared.js'
 
 /** Character bigrams (whitespace removed, works for Chinese) plus ASCII words of 3+ characters. */
 export function textGrams(text) {
@@ -18,6 +18,23 @@ export function textGrams(text) {
   return out
 }
 
+/**
+ * Re-apply the current sensitive-column rules to a cached schema (rules change between
+ * versions, e.g. a bare `token` currency column is no longer sensitive). Only the
+ * 'sensitive' role is touched; other roles stay as analysed.
+ */
+export function reclassifySensitive(schema) {
+  if (!schema?.tables || schema.sensitiveRules === SENSITIVE_RULES_VERSION) return schema
+  for (const t of schema.tables) for (const c of t.columns ?? []) {
+    const want = classifyColumn(c, t).includes('sensitive')
+    const has = (c.roles ?? []).includes('sensitive')
+    if (want && !has) c.roles = [...(c.roles ?? []), 'sensitive']
+    if (!want && has) c.roles = c.roles.filter(r => r !== 'sensitive')
+  }
+  schema.sensitiveRules = SENSITIVE_RULES_VERSION
+  return schema
+}
+
 export const methods = {
   // --------------------------------------------------------------- schema
 
@@ -87,6 +104,7 @@ export const methods = {
     if (previous && settings.schemaWatch !== false) {
       try { this.recordSchemaChange(ds, previous, schema) } catch (error) { console.warn('nl2sql: schema diff failed: %s', error.message) }
     }
+    schema.sensitiveRules = SENSITIVE_RULES_VERSION
     this.schemas.set(ds.id, schema)
     ds.schemaAnalyzedAt = schema.analyzedAt
     if (raw.version && !ds.serverVersion) ds.serverVersion = raw.version
@@ -97,7 +115,7 @@ export const methods = {
 
   async readSchemaFile(id) {
     try {
-      return JSON.parse(await readFile(join(this.dir, `schema-${id}.json`), 'utf8'))
+      return reclassifySensitive(JSON.parse(await readFile(join(this.dir, `schema-${id}.json`), 'utf8')))
     } catch {
       return undefined
     }

package/service/shared.js

@@ -57,14 +57,24 @@ export function pick(obj, keys) {
   return out
 }
 
-// "token" alone is ambiguous (crypto token_code / token_price are business data):
-// only credential-like token names count as sensitive.
-export const SENSITIVE_NAME = /(phone|mobile|tel|email|mail|id_?card|idno|identity|passport|password|passwd|pwd|secret|(?:access|auth|api|refresh|session|bearer|csrf|jwt|push|device)_?token|^token$|token_?(?:hash|secret|key)$|bank_?card|card_?no|身份证|手机|电话|邮箱|密码)/i
+// "token" alone is ambiguous: in crypto / payment schemas it is the currency (USDT, BTC…), so a
+// bare `token` column is NOT sensitive by name. Credential-like names (access_token, api_token,
+// token_hash, …) are; a bare `token` counts only in credential tables or with a credential comment
+// (see isCredentialToken). Mask anything else explicitly with the access policy's masked columns.
+export const SENSITIVE_NAME = /(phone|(?:^|_)mobile(?:_?(?:no|num|number))?(?:_|$)|(?:^|_)tel(?:ephone)?(?:_?(?:no|num|number))?(?:_|$)|e_?mail|(?:^|_)mail(?:_?addr(?:ess)?)?(?:_|$)|id_?card|idno|identity_?(?:no|num|number|card)|passport|password|passwd|pwd|secret|(?:access|auth|api|refresh|session|bearer|csrf|jwt|push|device)_?token|token_?(?:hash|secret|key)$|bank_?card|card_?no|身份证|手机|电话|邮箱|密码)/i
+const CREDENTIAL_TABLE = /(session|oauth|auth|login|credential|api_?key|access_?key|personal_?access|user_?token|refresh_?token|jwt|sso)/i
+const CREDENTIAL_COMMENT = /(令牌|凭证|凭据|密钥|访问码|登录态|credential|access token|auth token|bearer|jwt)/i
+/** A bare `token` column that holds a credential (by table name or comment), not a currency. */
+export function isCredentialToken(name, table, comment) {
+  return /^token$/i.test(String(name ?? '')) && (CREDENTIAL_TABLE.test(String(table ?? '')) || CREDENTIAL_COMMENT.test(String(comment ?? '')))
+}
+/** Bumped whenever the sensitive-column rules change (part of result cache keys). */
+export const SENSITIVE_RULES_VERSION = 3
 
 export function maskValue(column, value) {
   if (value === null || value === undefined) return value
   const s = String(value)
-  if (/(password|passwd|pwd|secret|token|密码)/i.test(column)) return '******'
+  if (/(password|passwd|pwd|secret|密码)/i.test(column) || /(?:access|auth|api|refresh|session|bearer|csrf|jwt|push|device)_?token|token_?(?:hash|secret|key)$|^token$/i.test(column)) return '******'
   if (/(email|mail|邮箱)/i.test(column) && s.includes('@')) {
     const [u, d] = s.split('@')
     return `${u.slice(0, 1)}***@${d}`
@@ -91,10 +101,9 @@ export function classifyColumn(col, table) {
   if (t === 'enum' || t === 'set' || (ENUM_NAME.test(name) && (t === 'tinyint' || t === 'smallint' || t === 'char' || t === 'varchar' || t === 'int'))) roles.push('enum')
   if (NUMERIC_TYPES.has(t) && !roles.includes('id') && !roles.includes('enum') && !roles.includes('time') && !/^is_|^has_/.test(name)) roles.push('measure')
   if (TEXT_TYPES.has(t) && GEO_NAME.test(name)) roles.push('geo')
-  if (SENSITIVE_NAME.test(name) || SENSITIVE_NAME.test(col.comment ?? '')) roles.push('sensitive')
+  if (SENSITIVE_NAME.test(name) || SENSITIVE_NAME.test(col.comment ?? '') || isCredentialToken(name, typeof table === 'string' ? table : table?.name, col.comment)) roles.push('sensitive')
   if (/^is_|^has_/.test(name) || col.columnType === 'tinyint(1)' || t === 'bit') roles.push('flag')
   if (roles.length === 0 && TEXT_TYPES.has(t)) roles.push('text')
-  void table
   return roles
 }