@malloy-publisher/server 0.0.129 → 0.0.131

package/src/service/connection.ts

@@ -143,6 +143,54 @@ function handleAlreadyAttachedError(error: unknown, dbName: string): void {
    }
 }
 
+function normalizePrivateKey(privateKey: string): string {
+   let privateKeyContent = privateKey.trim();
+
+   if (!privateKeyContent.includes("\n")) {
+      // Try encrypted key first, then unencrypted
+      const keyPatterns = [
+         {
+            beginRegex: /-----BEGIN\s+ENCRYPTED\s+PRIVATE\s+KEY-----/i,
+            endRegex: /-----END\s+ENCRYPTED\s+PRIVATE\s+KEY-----/i,
+            beginMarker: "-----BEGIN ENCRYPTED PRIVATE KEY-----",
+            endMarker: "-----END ENCRYPTED PRIVATE KEY-----",
+         },
+         {
+            beginRegex: /-----BEGIN\s+PRIVATE\s+KEY-----/i,
+            endRegex: /-----END\s+PRIVATE\s+KEY-----/i,
+            beginMarker: "-----BEGIN PRIVATE KEY-----",
+            endMarker: "-----END PRIVATE KEY-----",
+         },
+      ];
+
+      for (const pattern of keyPatterns) {
+         const beginMatch = privateKeyContent.match(pattern.beginRegex);
+         const endMatch = privateKeyContent.match(pattern.endRegex);
+
+         if (beginMatch && endMatch) {
+            const beginPos = beginMatch.index! + beginMatch[0].length;
+            const endPos = endMatch.index!;
+            const keyData = privateKeyContent
+               .substring(beginPos, endPos)
+               .replace(/\s+/g, "");
+
+            const lines: string[] = [];
+            for (let i = 0; i < keyData.length; i += 64) {
+               lines.push(keyData.slice(i, i + 64));
+            }
+            privateKeyContent = `${pattern.beginMarker}\n${lines.join("\n")}\n${pattern.endMarker}\n`;
+            break;
+         }
+      }
+   } else {
+      if (!privateKeyContent.endsWith("\n")) {
+         privateKeyContent += "\n";
+      }
+   }
+
+   return privateKeyContent;
+}
+
 // Database-specific attachment handlers
 async function attachBigQuery(
    connection: DuckDBConnection,
@@ -497,23 +545,53 @@ export async function createProjectConnections(
                throw new Error("Snowflake username is required.");
             }
 
-            if (!connection.snowflakeConnection.password) {
-               throw new Error("Snowflake password is required.");
+            if (
+               !connection.snowflakeConnection.password &&
+               !connection.snowflakeConnection.privateKey
+            ) {
+               throw new Error(
+                  "Snowflake password or private key or private key path is required.",
+               );
             }
 
             if (!connection.snowflakeConnection.warehouse) {
                throw new Error("Snowflake warehouse is required.");
             }
 
+            let privateKeyPath = undefined;
+
+            if (connection.snowflakeConnection.privateKey) {
+               privateKeyPath = path.join(
+                  TEMP_DIR_PATH,
+                  `${connection.name}-${uuidv4()}-private-key.pem`,
+               );
+               const normalizedKey = normalizePrivateKey(
+                  connection.snowflakeConnection.privateKey as string,
+               );
+               await fs.writeFile(privateKeyPath, normalizedKey);
+            }
+
             const snowflakeConnectionOptions = {
                connOptions: {
                   account: connection.snowflakeConnection.account,
                   username: connection.snowflakeConnection.username,
-                  password: connection.snowflakeConnection.password,
                   warehouse: connection.snowflakeConnection.warehouse,
                   database: connection.snowflakeConnection.database,
                   schema: connection.snowflakeConnection.schema,
                   role: connection.snowflakeConnection.role,
+                  ...(connection.snowflakeConnection.privateKey
+                     ? {
+                          privateKeyPath: privateKeyPath,
+                          authenticator: "SNOWFLAKE_JWT",
+                          privateKeyPass:
+                             connection.snowflakeConnection.privateKeyPass ||
+                             undefined,
+                       }
+                     : {
+                          password:
+                             connection.snowflakeConnection.password ||
+                             undefined,
+                       }),
                   timeout:
                      connection.snowflakeConnection.responseTimeoutMilliseconds,
                },