@mongoosejs/studio 0.4.0 → 0.5.0

package/README.md

@@ -12,6 +12,7 @@ For local dev, if your app runs on `localhost:3000`, Studio will be on `localhos
 
 By default, Mongoose Studio does **not** provide any authentication or authorization.
 You can use Mongoose Studio for free for local development, but we recommend [Mongoose Studio Pro](https://studio.mongoosejs.io/#pricing) for when you want to go into production.
+When you omit an API key, Mongoose Studio only accepts localhost connections by default.
 
 First, `npm install @mongoosejs/studio`.
 
@@ -43,6 +44,14 @@ opts.googleGeminiAPIKey = process.env.GOOGLE_GEMINI_API_KEY;
 app.use('/studio', await studio('/studio/api', mongoose, opts));
 ```
 
+Without an API key, you can allow access from additional IP addresses with `bindIp`, similar to MongoDB's `bindIp` option. `bindIp` may be a comma-separated string or an array of exact IP addresses. Set `bindIp` to `null` to allow unauthenticated connections from anywhere.
+
+```javascript
+app.use('/studio', await studio('/studio/api', mongoose, {
+  bindIp: '127.0.0.1,192.168.0.10'
+}));
+```
+
 ### Next.js
 
 First, add `withMongooseStudio` to your `next.config.js` file:

package/backend/actions/ChatMessage/executeScript.js

@@ -2,9 +2,8 @@
 
 const Archetype = require('archetype');
 const authorize = require('../../authorize');
-const MongooseStudioChartColors = require('../../constants/mongooseStudioChartColors');
+const createSandbox = require('../../sandbox/createSandbox');
 const mongoose = require('mongoose');
-const vm = require('vm');
 
 const ExecuteScriptParams = new Archetype({
   initiatedById: {
@@ -17,13 +16,16 @@ const ExecuteScriptParams = new Archetype({
   script: {
     $type: 'string'
   },
+  dryRun: {
+    $type: 'boolean'
+  },
   roles: {
     $type: ['string']
   }
 }).compile('ExecuteScriptParams');
 
 module.exports = ({ db, studioConnection }) => async function executeScript(params) {
-  const { initiatedById, chatMessageId, script, roles } = new ExecuteScriptParams(params);
+  const { initiatedById, chatMessageId, script, dryRun, roles } = new ExecuteScriptParams(params);
   const ChatThread = studioConnection.model('__Studio_ChatThread');
   const ChatMessage = studioConnection.model('__Studio_ChatMessage');
 
@@ -39,32 +41,19 @@ module.exports = ({ db, studioConnection }) => async function executeScript(para
     throw new Error('Unauthorized');
   }
 
-  // Create a sandbox with the db object
-  const logs = [];
-  if (!db.Types) {
-    db.Types = mongoose.Types;
-  }
-  const sandbox = { db, mongoose, console: {}, ObjectId: mongoose.Types.ObjectId, MongooseStudioChartColors };
-
-  // Capture console logs
-  sandbox.console.log = function() {
-    const args = Array.from(arguments);
-    logs.push(args.map(arg => typeof arg === 'object' ? JSON.stringify(arg) : arg).join(' '));
-  };
-
-  const context = vm.createContext(sandbox);
+  const sandbox = createSandbox({ db });
 
   let output;
   let error;
 
   try {
     // Execute the script in the sandbox
-    output = await vm.runInContext(wrappedScript(script), context);
+    output = await sandbox.runScript({ script, dryRun });
 
     const updatedContent = updateContentWithScript(chatMessage.content, chatMessage.script, script);
     chatMessage.script = script;
     chatMessage.content = updatedContent;
-    chatMessage.executionResult = { output, logs: logs.join('\n'), error: null };
+    chatMessage.executionResult = { output, logs: sandbox.getLogs(), error: null, dryRun: !!dryRun };
     await chatMessage.save();
 
     return { chatMessage };
@@ -80,20 +69,23 @@ module.exports = ({ db, studioConnection }) => async function executeScript(para
         content: updatedContent,
         executionResult: {
           output: null,
-          logs: logs.join('\n'),
-          error
+          logs: sandbox.getLogs(),
+          error,
+          dryRun: !!dryRun
         }
       }
     );
 
     throw new Error(`Script execution failed: ${error}`);
+  } finally {
+    try {
+      await sandbox.close();
+    } catch (_) {
+      // Ignore sandbox cleanup errors so they do not mask the primary result.
+    }
   }
 };
 
-const wrappedScript = script => `(async () => {
-  ${script}
-})()`;
-
 function updateContentWithScript(content, previousScript, newScript) {
   if (typeof content !== 'string') {
     return content;

package/backend/actions/Model/getDocuments.js

@@ -5,7 +5,7 @@ const removeSpecifiedPaths = require('../../helpers/removeSpecifiedPaths');
 const evaluateFilter = require('../../helpers/evaluateFilter');
 const getRefFromSchemaType = require('../../helpers/getRefFromSchemaType');
 const getSuggestedProjection = require('../../helpers/getSuggestedProjection');
-const parseFieldsParam = require('../../helpers/parseFieldsParam');
+const parseProjectionParam = require('../../helpers/parseProjectionParam');
 const authorize = require('../../authorize');
 
 const GetDocumentsParams = new Archetype({
@@ -32,7 +32,7 @@ const GetDocumentsParams = new Archetype({
   sortDirection: {
     $type: 'number'
   },
-  fields: {
+  projectionInput: {
     $type: 'string'
   },
   roles: {
@@ -45,7 +45,7 @@ module.exports = ({ db }) => async function getDocuments(params) {
   const { roles } = params;
   await authorize('Model.getDocuments', roles);
 
-  const { model, limit, skip, sortKey, sortDirection, searchText, fields } = params;
+  const { model, limit, skip, sortKey, sortDirection, searchText, projectionInput } = params;
 
   const Model = db.models[model];
   if (Model == null) {
@@ -68,7 +68,10 @@ module.exports = ({ db }) => async function getDocuments(params) {
   }
 
   let query = Model.find(filter).limit(limit).skip(skip).sort(sortObj);
-  const projection = parseFieldsParam(fields);
+  const projection = parseProjectionParam({
+    projectionInput,
+    schemaPaths: Object.keys(Model.schema.paths)
+  });
   if (projection != null) {
     query = query.select(projection);
   }

package/backend/actions/Model/getDocumentsStream.js

@@ -5,7 +5,7 @@ const removeSpecifiedPaths = require('../../helpers/removeSpecifiedPaths');
 const evaluateFilter = require('../../helpers/evaluateFilter');
 const getRefFromSchemaType = require('../../helpers/getRefFromSchemaType');
 const getSuggestedProjection = require('../../helpers/getSuggestedProjection');
-const parseFieldsParam = require('../../helpers/parseFieldsParam');
+const parseProjectionParam = require('../../helpers/parseProjectionParam');
 const authorize = require('../../authorize');
 
 const GetDocumentsParams = new Archetype({
@@ -32,7 +32,7 @@ const GetDocumentsParams = new Archetype({
   sortDirection: {
     $type: 'number'
   },
-  fields: {
+  projectionInput: {
     $type: 'string'
   },
   roles: {
@@ -45,7 +45,7 @@ module.exports = ({ db }) => async function* getDocumentsStream(params) {
   const { roles } = params;
   await authorize('Model.getDocumentsStream', roles);
 
-  const { model, limit, skip, sortKey, sortDirection, searchText, fields } = params;
+  const { model, limit, skip, sortKey, sortDirection, searchText, projectionInput } = params;
 
   const Model = db.models[model];
   if (Model == null) {
@@ -68,7 +68,10 @@ module.exports = ({ db }) => async function* getDocumentsStream(params) {
   }
 
   let query = Model.find(filter).limit(limit).skip(skip).sort(sortObj).batchSize(1);
-  const projection = parseFieldsParam(fields);
+  const projection = parseProjectionParam({
+    projectionInput,
+    schemaPaths: Object.keys(Model.schema.paths)
+  });
   if (projection != null) {
     query = query.select(projection);
   }

package/backend/actions/getCapabilities.js

@@ -0,0 +1,42 @@
+'use strict';
+
+module.exports = ({ db, options }) => async function getCapabilities() {
+  const connection = db?.connection ?? db;
+  const admin = typeof connection?.db?.admin === 'function' ? connection.db.admin() : null;
+  const supportsAI = hasAIProviderKey(options);
+
+  if (admin == null || typeof admin.command !== 'function') {
+    return {
+      supportsChangeStreams: false,
+      supportsTransactions: false,
+      supportsAI
+    };
+  }
+
+  let hello;
+  try {
+    hello = await admin.command({ hello: 1 });
+  } catch (err) {
+    hello = await admin.command({ isMaster: 1 });
+  }
+
+  const maxWireVersion = hello?.maxWireVersion ?? 0;
+  const supportsModernMongoFeatures = maxWireVersion >= 7;
+  const isReplicaSet = !!hello?.setName;
+  const isMongos = hello?.msg === 'isdbgrid';
+  const hasSessions = hello?.logicalSessionTimeoutMinutes != null;
+
+  return {
+    supportsChangeStreams: supportsModernMongoFeatures && (isReplicaSet || isMongos),
+    supportsTransactions: supportsModernMongoFeatures && hasSessions && (isReplicaSet || isMongos),
+    supportsAI
+  };
+};
+
+function hasAIProviderKey(options) {
+  return [
+    options?.openAIAPIKey,
+    options?.anthropicAPIKey,
+    options?.googleGeminiAPIKey
+  ].some(value => typeof value === 'string' ? value.trim().length > 0 : !!value);
+}

package/backend/actions/index.js

@@ -3,7 +3,7 @@
 exports.ChatMessage = require('./ChatMessage');
 exports.ChatThread = require('./ChatThread');
 exports.Dashboard = require('./Dashboard');
+exports.getCapabilities = require('./getCapabilities');
 exports.Model = require('./Model');
-exports.Script = require('./Script');
 exports.status = require('./status');
 exports.Task = require('./Task');

package/backend/db/chatMessageSchema.js

@@ -28,7 +28,8 @@ const chatMessageSchema = new mongoose.Schema({
   executionResult: {
     output: mongoose.Schema.Types.Mixed,
     logs: String,
-    error: String
+    error: String,
+    dryRun: Boolean
   }
 }, { timestamps: true });
 

package/backend/helpers/isBindIPConnection.js

@@ -0,0 +1,8 @@
+'use strict';
+
+module.exports = function isBindIPConnection(req, bindIp) {
+  if (bindIp == null) {
+    return true;
+  }
+  return bindIp.includes(req.ip || '');
+};

package/backend/helpers/isLocalhostConnection.js

@@ -0,0 +1,8 @@
+'use strict';
+
+module.exports = function isLocalhostConnection(req) {
+  const remoteAddress = req.ip || '';
+  return remoteAddress === '127.0.0.1' ||
+    remoteAddress === '::1' ||
+    remoteAddress === '::ffff:127.0.0.1';
+};

package/backend/helpers/normalizeBindIPOption.js

@@ -0,0 +1,16 @@
+'use strict';
+
+module.exports = function normalizeBindIPOption(bindIp) {
+  if (bindIp === null) {
+    return null;
+  }
+  if (bindIp === undefined) {
+    return ['localhost'];
+  }
+
+  const bindIps = Array.isArray(bindIp) ? bindIp : `${bindIp}`.split(',');
+  return bindIps.
+    flatMap(bindIp => `${bindIp}`.split(',')).
+    map(bindIp => bindIp.trim()).
+    filter(bindIp => bindIp.length > 0);
+};

package/backend/helpers/parseProjectionParam.js

@@ -0,0 +1,180 @@
+'use strict';
+
+/**
+ * Parse a raw projection input string into a Query.select()-compatible projection.
+ *
+ * Supports:
+ * - `name email`
+ * - `-password`
+ * - `+email`
+ * - `{ deletedAt: 1 }`
+ * - `{ password: 0 }`
+ *
+ * @param {Object} options
+ * @param {string|undefined} options.projectionInput
+ * @param {string[]} options.schemaPaths
+ * @returns {string|object|null}
+ */
+function parseProjectionParam({ projectionInput, schemaPaths }) {
+  return parseProjectionInput(projectionInput, schemaPaths);
+}
+
+function parseProjectionInput(projectionInput, schemaPaths) {
+  if (projectionInput == null || typeof projectionInput !== 'string') {
+    return null;
+  }
+  const trimmed = projectionInput.trim();
+  if (!trimmed) {
+    return null;
+  }
+
+  if (trimmed.startsWith('{') && trimmed.endsWith('}')) {
+    return parseProjectionObjectNotation(trimmed, schemaPaths);
+  }
+
+  const tokens = normalizeProjectionTokens(trimmed);
+  if (tokens === null || tokens.length === 0) {
+    return null;
+  }
+
+  const includeKeys = [];
+  const excludeKeys = [];
+
+  for (const rawToken of tokens) {
+    const token = rawToken.trim();
+    if (!token) {
+      continue;
+    }
+
+    const prefix = token[0];
+    if (prefix === '-') {
+      const path = token.slice(1).trim();
+      if (!path) {
+        return null;
+      }
+      excludeKeys.push(path);
+    } else if (prefix === '+') {
+      const path = token.slice(1).trim();
+      if (!path) {
+        return null;
+      }
+      includeKeys.push(path);
+    } else {
+      includeKeys.push(token);
+    }
+  }
+
+  if (includeKeys.length > 0 && excludeKeys.length > 0) {
+    const includeSet = new Set(includeKeys);
+    for (const path of excludeKeys) {
+      const ex = path;
+      for (const key of Array.from(includeSet)) {
+        if (key.toLowerCase() === ex.toLowerCase()) {
+          includeSet.delete(key);
+        }
+      }
+    }
+    if (includeSet.size === 0) {
+      return null;
+    }
+    return Array.from(includeSet).join(' ');
+  }
+
+  if (excludeKeys.length > 0) {
+    return excludeKeys.map(path => `-${path}`).join(' ');
+  }
+
+  return includeKeys.join(' ');
+}
+
+function normalizeProjectionTokens(trimmed) {
+  const rawTokens = trimmed.split(/[,\s]+/).filter(Boolean);
+  const tokens = [];
+  for (let i = 0; i < rawTokens.length; i++) {
+    const token = rawTokens[i];
+    if (token === '-' || token === '+') {
+      if (i + 1 >= rawTokens.length) {
+        return null;
+      }
+      tokens.push(token + rawTokens[++i]);
+    } else {
+      tokens.push(token);
+    }
+  }
+  return tokens;
+}
+
+function parseProjectionObjectNotation(trimmed, schemaPaths) {
+  const body = trimmed.slice(1, -1).trim();
+  if (!body) {
+    return null;
+  }
+
+  const pairRe = /(?:^|,)\s*(?:"([^"]+)"|'([^']+)'|([a-zA-Z_$][\w.$]*))\s*:\s*("[^"]*"|'[^']*'|[^,]+?)\s*(?=,|$)/g;
+  const includeKeys = [];
+  const excludeKeys = [];
+  let matchedChars = '';
+  let match;
+
+  while ((match = pairRe.exec(body)) !== null) {
+    matchedChars += match[0];
+    const key = (match[1] || match[2] || match[3] || '').trim();
+    const rawValue = (match[4] || '').trim();
+    if (!key || !rawValue) {
+      return null;
+    }
+    if (key === '__proto__' || key === 'constructor') {
+      throw new Error(`Invalid key: ${key}`);
+    }
+
+    const valueLower = rawValue.replace(/^['"]|['"]$/g, '').trim().toLowerCase();
+    const isInclude = valueLower === '1' || valueLower === 'true';
+    const isExclude = valueLower === '0' || valueLower === 'false';
+    if (!isInclude && !isExclude) {
+      return null;
+    }
+    if (isInclude) {
+      includeKeys.push(key);
+    } else {
+      excludeKeys.push(key);
+    }
+  }
+
+  const normalizedBody = body.replace(/\s+/g, '');
+  const normalizedMatched = matchedChars.replace(/\s+/g, '').replace(/^,/, '');
+  if (!normalizedMatched || normalizedMatched !== normalizedBody) {
+    return null;
+  }
+
+  if (includeKeys.length > 0 && excludeKeys.length > 0) {
+    const includeSet = new Set(includeKeys);
+    for (const path of excludeKeys) {
+      const ex = path;
+      for (const key of Array.from(includeSet)) {
+        if (key.toLowerCase() === ex.toLowerCase()) {
+          includeSet.delete(key);
+        }
+      }
+    }
+    if (includeSet.size === 0) {
+      return null;
+    }
+    return Array.from(includeSet).join(' ');
+  }
+
+  if (excludeKeys.length > 0) {
+    const projection = {};
+    for (const path of excludeKeys) {
+      projection[path] = 0;
+    }
+    return Object.keys(projection).length > 0 ? projection : null;
+  }
+
+  const projection = {};
+  for (const path of includeKeys) {
+    projection[path] = 1;
+  }
+  return Object.keys(projection).length > 0 ? projection : null;
+}
+
+module.exports = parseProjectionParam;

package/backend/sandbox/createSandbox.js

@@ -0,0 +1,83 @@
+'use strict';
+
+const MongooseStudioChartColors = require('../constants/mongooseStudioChartColors');
+const mongoose = require('mongoose');
+const vm = require('vm');
+const { createScriptDb } = require('./createScriptDb');
+
+module.exports = function createSandbox({ db }) {
+  const logs = [];
+  const scriptDb = createScriptDb(db);
+  if (!scriptDb.db.Types) {
+    scriptDb.db.Types = mongoose.Types;
+  }
+
+  const sandbox = {
+    db: scriptDb.db,
+    mongoose,
+    console: {},
+    ObjectId: mongoose.Types.ObjectId,
+    MongooseStudioChartColors
+  };
+
+  sandbox.console.log = function() {
+    const args = Array.from(arguments);
+    logs.push(args.map(arg => typeof arg === 'object' ? JSON.stringify(arg) : arg).join(' '));
+  };
+
+  return {
+    context: vm.createContext(sandbox),
+    db: scriptDb.db,
+    getLogs() {
+      return logs.join('\n');
+    },
+    setDryRunSession: scriptDb.setDryRunSession,
+    async runScript({ script, dryRun }) {
+      const wrappedScript = `(async () => {
+        ${script}
+      })()`;
+
+      if (!dryRun) {
+        return await vm.runInContext(wrappedScript, this.context);
+      }
+
+      return await runDryRunScript({
+        db: this.db,
+        context: this.context,
+        setDryRunSession: this.setDryRunSession,
+        wrappedScript
+      });
+    },
+    close: scriptDb.close
+  };
+};
+
+async function runDryRunScript({ db, context, setDryRunSession, wrappedScript }) {
+  if (typeof db?.startSession !== 'function') {
+    throw new Error('Dry run mode requires MongoDB sessions support');
+  }
+
+  const session = await db.startSession();
+  setDryRunSession(session);
+
+  try {
+    session.startTransaction();
+    const result = await vm.runInContext(wrappedScript, context);
+    await abortTransaction(session);
+    return result;
+  } catch (err) {
+    await abortTransaction(session);
+    throw err;
+  } finally {
+    setDryRunSession(null);
+    await session.endSession().catch(() => {});
+  }
+}
+
+async function abortTransaction(session) {
+  if (typeof session?.inTransaction === 'function' && !session.inTransaction()) {
+    return;
+  }
+
+  await session.abortTransaction().catch(() => {});
+}