@malloy-publisher/server 0.10.1 → 0.10.2

package/dist/server.mjs

@@ -164832,7 +164832,7 @@ var init_telemetry = __esm(() => {
 });
 
 // package.json
-var version = "0.10.1";
+var version = "0.10.2";
 var init_package = () => {};
 
 // src/version.ts
@@ -263961,6 +263961,45 @@ var init_introspection_sql = __esm(() => {
 });
 
 // src/service/gcs_s3_utils.ts
+function parseS3Endpoint(endpoint) {
+  const scheme = /^([a-z][a-z0-9+.-]*):\/\//i.exec(endpoint);
+  const protocol = scheme?.[1].toLowerCase();
+  if (protocol !== undefined && protocol !== "http" && protocol !== "https") {
+    throw new Error(`S3 endpoint scheme must be http:// or https://, got ${protocol}://`);
+  }
+  if (/\s/.test(endpoint)) {
+    throw new Error("S3 endpoint must not contain whitespace");
+  }
+  if (/[?#]/.test(endpoint)) {
+    throw new Error("S3 endpoint must not contain a query string or fragment");
+  }
+  let end = endpoint.length;
+  while (end > 0 && endpoint[end - 1] === "/")
+    end--;
+  const hostAndPath = endpoint.slice(scheme ? scheme[0].length : 0, end);
+  if (!hostAndPath) {
+    throw new Error("S3 endpoint must include a host");
+  }
+  if (hostAndPath.startsWith("/")) {
+    throw new Error("S3 endpoint must include a host before any path");
+  }
+  if (hostAndPath.split("/", 1)[0].includes("@")) {
+    throw new Error("S3 endpoint must not contain userinfo");
+  }
+  const useSsl = protocol !== "http";
+  return {
+    hostAndPath,
+    useSsl,
+    url: `${useSsl ? "https" : "http"}://${hostAndPath}`
+  };
+}
+function checkS3Endpoint(endpoint, provider) {
+  const parsed = parseS3Endpoint(endpoint);
+  if (!parsed.useSsl && provider === "credential_chain") {
+    throw new Error("S3 endpoint must use https:// with provider credential_chain: its requests carry the host's credentials");
+  }
+  return parsed;
+}
 function gcsConnectionToCredentials(gcsConnection) {
   return {
     type: "gcs",
@@ -264025,6 +264064,13 @@ function resolveCloudStorageCredentials(attachedDb, origin2 = "connection") {
   }
   const s3 = attachedDb.s3Connection;
   validateS3ProviderShape(s3, attachedDb.name, origin2);
+  if (typeof s3.endpoint === "string" && s3.endpoint !== "") {
+    try {
+      checkS3Endpoint(s3.endpoint, s3.provider);
+    } catch (error) {
+      throw new Error(`${error.message} (${attachedDb.name})`);
+    }
+  }
   if (s3.provider !== "credential_chain" && (!s3.accessKeyId || !s3.secretAccessKey)) {
     throw new Error(`S3 accessKeyId and secretAccessKey are required for: ${attachedDb.name}`);
   }
@@ -264043,7 +264089,7 @@ function createCloudStorageClient(credentials) {
   const isGCS = credentials.type === "gcs";
   const useHostCredentials = !isGCS && credentials.provider === "credential_chain";
   const client = new import_client_s3.S3Client({
-    endpoint: isGCS ? "https://storage.googleapis.com" : credentials.endpoint,
+    endpoint: isGCS ? "https://storage.googleapis.com" : credentials.endpoint ? checkS3Endpoint(credentials.endpoint, credentials.provider).url : undefined,
     region: isGCS ? "auto" : credentials.region || "us-east-1",
     ...useHostCredentials ? {} : {
       credentials: {
@@ -268914,11 +268960,6 @@ var require_utils93 = __commonJS((exports, module) => {
   };
 });
 
-// ../../node_modules/ssh2/lib/protocol/crypto/build/Release/sshcrypto.node
-var require_sshcrypto = __commonJS((exports, module) => {
-  module.exports = __require("./sshcrypto-cqb52edz.node");
-});
-
 // ../../node_modules/ssh2/lib/protocol/crypto/poly1305.js
 var require_poly1305 = __commonJS((exports, module) => {
   var __dirname = "/home/runner/work/publisher/publisher/node_modules/ssh2/lib/protocol/crypto", __filename = "/home/runner/work/publisher/publisher/node_modules/ssh2/lib/protocol/crypto/poly1305.js";
@@ -269405,7 +269446,7 @@ var require_crypto = __commonJS((exports, module) => {
   var ChaChaPolyDecipher;
   var GenericDecipher;
   try {
-    binding = require_sshcrypto();
+    binding = (()=>{throw new Error("Cannot require module "+"./crypto/build/Release/sshcrypto.node");})();
     ({
       AESGCMCipher,
       ChaChaPolyCipher,
@@ -295454,57 +295495,40 @@ function buildCloudStorageSecretSQL(secretName, credentials) {
     if (!credentials.region) {
       logger.warn("S3 connection has no region; defaulting to us-east-1. A bucket in " + "another region will not be found.", { secretName });
     }
+    let clauses;
     if (credentials.provider === "credential_chain") {
       const chain = escapeSQL(credentials.chain?.trim() || DEFAULT_S3_CREDENTIAL_CHAIN);
-      const clauses = [
+      clauses = [
         "TYPE s3",
         "PROVIDER credential_chain",
         `CHAIN '${chain}'`,
         "REFRESH 'auto'",
         `REGION '${region}'`
       ];
-      if (credentials.endpoint) {
-        clauses.push(`ENDPOINT '${escapeSQL(credentials.endpoint)}'`, "URL_STYLE 'path'");
+    } else {
+      clauses = [
+        "TYPE s3",
+        `KEY_ID '${escapedKeyId}'`,
+        `SECRET '${escapedSecret}'`,
+        `REGION '${region}'`
+      ];
+    }
+    if (credentials.endpoint) {
+      const { hostAndPath, useSsl } = checkS3Endpoint(credentials.endpoint, credentials.provider);
+      clauses.push(`ENDPOINT '${escapeSQL(hostAndPath)}'`, "URL_STYLE 'path'");
+      if (!useSsl) {
+        clauses.push("USE_SSL false");
       }
-      createSecretCommand = `
+    }
+    if (credentials.provider !== "credential_chain" && credentials.sessionToken) {
+      clauses.push(`SESSION_TOKEN '${escapeSQL(credentials.sessionToken)}'`);
+    }
+    createSecretCommand = `
             CREATE OR REPLACE SECRET ${secretName} (
                ${clauses.join(`,
                `)}
             );
          `;
-    } else if (credentials.endpoint) {
-      const escapedEndpoint = escapeSQL(credentials.endpoint);
-      createSecretCommand = `
-            CREATE OR REPLACE SECRET ${secretName} (
-               TYPE s3,
-               KEY_ID '${escapedKeyId}',
-               SECRET '${escapedSecret}',
-               REGION '${region}',
-               ENDPOINT '${escapedEndpoint}',
-               URL_STYLE 'path'
-            );
-         `;
-    } else if (credentials.sessionToken) {
-      const escapedToken = escapeSQL(credentials.sessionToken);
-      createSecretCommand = `
-            CREATE OR REPLACE SECRET ${secretName} (
-               TYPE s3,
-               KEY_ID '${escapedKeyId}',
-               SECRET '${escapedSecret}',
-               REGION '${region}',
-               SESSION_TOKEN '${escapedToken}'
-            );
-         `;
-    } else {
-      createSecretCommand = `
-            CREATE OR REPLACE SECRET ${secretName} (
-               TYPE s3,
-               KEY_ID '${escapedKeyId}',
-               SECRET '${escapedSecret}',
-               REGION '${region}'
-            );
-         `;
-    }
   }
   return createSecretCommand;
 }
@@ -305734,7 +305758,7 @@ class ConnectionController {
     const connection = this.getApiConnectionForLookup(environment, connectionName);
     if (connection.type === "ducklake") {
       if (tablePath.split(".").length === 1) {
-        tablePath = `${connectionName}.${schemaName}.${tablePath}`;
+        tablePath = schemaName === tablePath ? `${connectionName}.${tablePath}` : `${connectionName}.${schemaName}.${tablePath}`;
       } else if (tablePath.split(".").length === 2 && !tablePath.startsWith(connectionName)) {
         tablePath = `${connectionName}.${tablePath}`;
       }
@@ -376935,6 +376959,13 @@ function catalogAdminConfigFromEnv(env) {
       if (!keyId || !secret) {
         throw new Error("PUBLISHER_ADMIN_STORAGE_PROVIDER=s3 needs PUBLISHER_ADMIN_STORAGE_KEY_ID and PUBLISHER_ADMIN_STORAGE_SECRET.");
       }
+      if (env.PUBLISHER_ADMIN_STORAGE_ENDPOINT) {
+        try {
+          parseS3Endpoint(env.PUBLISHER_ADMIN_STORAGE_ENDPOINT);
+        } catch (error) {
+          throw new Error(`PUBLISHER_ADMIN_STORAGE_ENDPOINT: ${error.message}`);
+        }
+      }
       storage = {
         s3Connection: {
           provider: "config",
@@ -377457,6 +377488,7 @@ var init_catalog_admin = __esm(() => {
   init_logger();
   init_connection();
   init_materialization_build_session();
+  init_gcs_s3_utils();
   init_pg_helpers();
   init_quoting();
   init_statement_usage();

package/package.json

@@ -19,7 +19,7 @@
       "snowflake"
    ],
    "homepage": "https://docs.malloydata.dev/documentation/user_guides/publishing/mcp_agents",
-   "version": "0.10.1",
+   "version": "0.10.2",
    "main": "dist/server.mjs",
    "bin": {
       "malloy-publisher": "dist/server.mjs"