@mtndev/cli 1.1.0 → 2.0.1

package/cjs/commands/db/create-readonly-user/handler.cjs

@@ -0,0 +1,254 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_rolldown_runtime = require("../../../__chunks/VH7oDXx4.cjs");
+const require_commands_aws_utils_tty = require("../../aws/utils/tty.cjs");
+const require_commands_db_create_readonly_user_utils = require("./utils.cjs");
+const require_commands_db_create_readonly_user_mysql = require("./mysql.cjs");
+const require_commands_db_create_readonly_user_postgres = require("./postgres.cjs");
+const require_commands_db_create_readonly_user_schema = require("./schema.cjs");
+let chalk = require("chalk");
+chalk = require_rolldown_runtime.__toESM(chalk, 1);
+let zod = require("zod");
+//#region src/commands/db/create-readonly-user/handler.js
+/**
+* @param {"postgres" | "mysql" | undefined} engineOption
+* @param {string | null} url
+* @returns {Promise<"postgres" | "mysql">}
+*/
+async function resolveEngine(engineOption, url) {
+	if (engineOption) return engineOption;
+	if (url) {
+		const detected = require_commands_db_create_readonly_user_utils.detectEngineFromUrl(url);
+		if (detected) return detected;
+	}
+	const index = await require_commands_aws_utils_tty.promptChoice({
+		message: "Choose a database engine:",
+		options: ["postgres", "mysql"]
+	});
+	const chosen = require_commands_db_create_readonly_user_schema.ENGINES[index];
+	if (!chosen) throw new Error("No engine selected");
+	return chosen;
+}
+/**
+* @param {{ urlOption?: string; engine: "postgres" | "mysql" }} params
+* @returns {Promise<string>}
+*/
+async function resolveUrl(params) {
+	const { urlOption, engine } = params;
+	const fromEnv = require_commands_db_create_readonly_user_utils.resolveAdminUrl({
+		url: urlOption,
+		engine
+	});
+	if (fromEnv) return fromEnv;
+	const raw = await require_commands_aws_utils_tty.prompt(`  Admin connection URL (e.g. ${engine === "postgres" ? "postgresql://admin:pass@host:5432/postgres" : "mysql://admin:pass@host:3306/"}): `);
+	if (!raw) throw new Error("Admin connection URL is required (pass --url or set DATABASE_URL)");
+	return raw;
+}
+/**
+* @param {{
+*   databaseOption?: string;
+*   databases: string[];
+* }} params
+* @returns {Promise<{ mode: "all" | "one"; databases: string[] }>}
+*/
+async function resolveScope(params) {
+	const { databaseOption, databases } = params;
+	if (databaseOption) {
+		const normalized = databaseOption.trim().toLowerCase();
+		if (normalized === "all" || normalized === "*") return {
+			mode: "all",
+			databases
+		};
+		if (!databases.includes(databaseOption)) throw new Error(`Database "${databaseOption}" not found. Available: ${databases.join(", ") || "(none)"}`);
+		return {
+			mode: "one",
+			databases: [databaseOption]
+		};
+	}
+	if (databases.length === 0) throw new Error("No user databases found to grant access on.");
+	const options = [...databases.map((name) => name), `all (${databases.length} databases)`];
+	const index = await require_commands_aws_utils_tty.promptChoice({
+		message: "Grant read-only on which database?",
+		options
+	});
+	if (index === options.length - 1) return {
+		mode: "all",
+		databases
+	};
+	const chosen = databases[index];
+	if (!chosen) throw new Error("No database selected");
+	return {
+		mode: "one",
+		databases: [chosen]
+	};
+}
+/**
+* @param {string | undefined} usernameOption
+* @returns {Promise<string>}
+*/
+async function resolveUsername(usernameOption) {
+	if (usernameOption) return usernameOption;
+	const username = await require_commands_aws_utils_tty.prompt(`  Read-only username [default: readonly]: `) || "readonly";
+	if (!/^[A-Za-z0-9_]+$/.test(username)) throw new Error("Username must contain only letters, numbers, and underscores");
+	return username;
+}
+/**
+* @param {string | undefined} passwordOption
+* @returns {Promise<{ password: string; generated: boolean }>}
+*/
+async function resolvePassword(passwordOption) {
+	if (passwordOption) return {
+		password: passwordOption,
+		generated: false
+	};
+	if (await require_commands_aws_utils_tty.promptYesNo({
+		message: "  Generate a random password?",
+		defaultYes: true
+	})) return {
+		password: require_commands_db_create_readonly_user_utils.generatePassword(),
+		generated: true
+	};
+	const password = await require_commands_aws_utils_tty.prompt("  Password: ");
+	if (!password) throw new Error("Password is required");
+	return {
+		password,
+		generated: false
+	};
+}
+/**
+* Redact password in a URL for display.
+* @param {string} url
+* @returns {string}
+*/
+function redactUrl(url) {
+	try {
+		const parsed = new URL(url);
+		if (parsed.password) parsed.password = "***";
+		return parsed.toString();
+	} catch {
+		return url;
+	}
+}
+/**
+* `db create-readonly-user` handler.
+* @param {unknown} options
+*/
+async function createReadonlyUserCommand(options) {
+	try {
+		const { engine: engineOption, url: urlOption, database: databaseOption, username: usernameOption, password: passwordOption, hostPattern: hostPatternOption, ssl: sslOption, yes, dryRun, verbose } = require_commands_db_create_readonly_user_schema.createReadonlyUserOptionsSchema.parse(options);
+		console.log(chalk.default.blue("\nCreate read-only database user"));
+		console.log("");
+		const engine = await resolveEngine(engineOption, require_commands_db_create_readonly_user_utils.resolveAdminUrl({
+			url: urlOption,
+			engine: engineOption
+		}));
+		console.log(`Engine: ${engine}`);
+		const url = await resolveUrl({
+			urlOption,
+			engine
+		});
+		const config = require_commands_db_create_readonly_user_utils.parseConnectionUrl({
+			url,
+			engine,
+			sslOption
+		});
+		console.log(`Admin:  ${config.user}@${config.host}:${config.port}` + (config.database ? `/${config.database}` : ""));
+		console.log("");
+		const listed = engine === "postgres" ? await require_commands_db_create_readonly_user_postgres.listPostgresDatabases(config) : await require_commands_db_create_readonly_user_mysql.listMysqlDatabases(config);
+		if (verbose) {
+			console.log(`Found databases: ${listed.join(", ") || "(none)"}`);
+			console.log("");
+		}
+		const scope = await resolveScope({
+			databaseOption,
+			databases: listed
+		});
+		console.log(scope.mode === "all" ? `Scope:  all (${scope.databases.length} databases)` : `Scope:  ${scope.databases[0]}`);
+		console.log("");
+		const username = await resolveUsername(usernameOption);
+		const { password, generated } = await resolvePassword(passwordOption);
+		const hostPattern = hostPatternOption ?? "%";
+		console.log("");
+		console.log("Plan:");
+		console.log(`  User:     ${username}`);
+		console.log(`  Password: ${generated ? "(generated)" : "(provided)"}${dryRun ? " [dry-run]" : ""}`);
+		if (engine === "mysql") console.log(`  Host:     ${hostPattern}`);
+		console.log(scope.mode === "all" ? `  Grants:   SELECT on ALL databases (${scope.databases.length})` : `  Grants:   SELECT on ${scope.databases[0]}`);
+		if (scope.mode === "all" && engine === "postgres") console.log(chalk.default.yellow("  Note:     Databases created later will NOT get these grants automatically — re-run this command."));
+		console.log("");
+		if (!yes && !dryRun) {
+			if (!await require_commands_aws_utils_tty.promptYesNo({
+				message: "Apply these changes?",
+				defaultYes: false
+			})) {
+				console.log("Aborted.");
+				return;
+			}
+			console.log("");
+		}
+		const result = engine === "postgres" ? await require_commands_db_create_readonly_user_postgres.applyPostgresReadonly({
+			config,
+			username,
+			password,
+			databases: scope.databases,
+			dryRun,
+			verbose
+		}) : await require_commands_db_create_readonly_user_mysql.applyMysqlReadonly({
+			config,
+			username,
+			password,
+			databases: scope.mode === "all" ? "all" : scope.databases,
+			hostPattern,
+			dryRun,
+			verbose
+		});
+		if (dryRun) {
+			console.log(chalk.default.cyan("Dry run — SQL that would run:"));
+			for (const statement of result.statements) console.log(`  ${statement}`);
+			console.log("");
+			console.log(chalk.default.cyan("No changes made."));
+			return;
+		}
+		console.log(chalk.default.green(result.created ? `Created user "${username}" and granted read-only access.` : `Updated user "${username}" password and refreshed read-only grants.`));
+		console.log("");
+		const sampleDb = scope.mode === "one" ? scope.databases[0] ?? "" : scope.databases[0] ?? "";
+		const readonlyUrl = require_commands_db_create_readonly_user_utils.buildReadonlyUrl({
+			engine,
+			host: config.host,
+			port: config.port,
+			username,
+			password,
+			database: sampleDb
+		});
+		console.log("Connection (secret shown once — copy now):");
+		console.log("────────────────────────────────────────────────────────────────");
+		console.log(readonlyUrl);
+		if (scope.mode === "all") {
+			console.log("");
+			console.log(chalk.default.gray(`  (URL uses database "${sampleDb}" as an example; user can connect to any granted database.)`));
+		}
+		console.log("────────────────────────────────────────────────────────────────");
+		console.log("");
+		console.log(chalk.default.gray(`Admin URL used: ${redactUrl(url)}`));
+	} catch (error) {
+		if (error instanceof zod.ZodError) {
+			console.error(chalk.default.red("\n❌ Invalid command options:"));
+			error.errors.forEach((err) => {
+				console.error(chalk.default.red(`   ${err.path.join(".")}: ${err.message}`));
+			});
+			process.exit(1);
+		}
+		const verbose = options?.verbose || false;
+		console.error(chalk.default.red("\n❌ create-readonly-user failed:"));
+		if (error instanceof Error) {
+			console.error(chalk.default.red(`   ${error.message}`));
+			if (verbose && error.stack) {
+				console.error(chalk.default.gray("\nStack trace:"));
+				console.error(chalk.default.gray(error.stack));
+			}
+		} else console.error(chalk.default.red(`   ${String(error)}`));
+		console.error(chalk.default.yellow("\n💡 Pass --url or set DATABASE_URL. Use --verbose for details.\n"));
+		process.exit(1);
+	}
+}
+//#endregion
+exports.createReadonlyUserCommand = createReadonlyUserCommand;

package/cjs/commands/db/create-readonly-user/handler.d.ts

@@ -0,0 +1,5 @@
+/**
+ * `db create-readonly-user` handler.
+ * @param {unknown} options
+ */
+export function createReadonlyUserCommand(options: unknown): Promise<void>;

package/cjs/commands/db/create-readonly-user/index.cjs

@@ -0,0 +1,18 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_commands_db_create_readonly_user_utils = require("./utils.cjs");
+const require_commands_db_create_readonly_user_schema = require("./schema.cjs");
+const require_commands_db_create_readonly_user_handler = require("./handler.cjs");
+exports.DEFAULT_MYSQL_HOST_PATTERN = require_commands_db_create_readonly_user_schema.DEFAULT_MYSQL_HOST_PATTERN;
+exports.DEFAULT_READONLY_USERNAME = require_commands_db_create_readonly_user_schema.DEFAULT_READONLY_USERNAME;
+exports.ENGINES = require_commands_db_create_readonly_user_schema.ENGINES;
+exports.buildReadonlyUrl = require_commands_db_create_readonly_user_utils.buildReadonlyUrl;
+exports.createReadonlyUserCommand = require_commands_db_create_readonly_user_handler.createReadonlyUserCommand;
+exports.createReadonlyUserOptionsSchema = require_commands_db_create_readonly_user_schema.createReadonlyUserOptionsSchema;
+exports.detectEngineFromUrl = require_commands_db_create_readonly_user_utils.detectEngineFromUrl;
+exports.generatePassword = require_commands_db_create_readonly_user_utils.generatePassword;
+exports.isSystemDatabase = require_commands_db_create_readonly_user_utils.isSystemDatabase;
+exports.parseConnectionUrl = require_commands_db_create_readonly_user_utils.parseConnectionUrl;
+exports.quoteIdent = require_commands_db_create_readonly_user_utils.quoteIdent;
+exports.quoteLiteral = require_commands_db_create_readonly_user_utils.quoteLiteral;
+exports.resolveAdminUrl = require_commands_db_create_readonly_user_utils.resolveAdminUrl;
+exports.resolveSsl = require_commands_db_create_readonly_user_utils.resolveSsl;

package/cjs/commands/db/create-readonly-user/index.d.ts

@@ -0,0 +1,3 @@
+export * from "./handler.js";
+export * from "./schema.js";
+export * from "./utils.js";

package/cjs/commands/db/create-readonly-user/mysql.cjs

@@ -0,0 +1,102 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_rolldown_runtime = require("../../../__chunks/VH7oDXx4.cjs");
+const require_commands_db_create_readonly_user_utils = require("./utils.cjs");
+let mysql2_promise = require("mysql2/promise");
+mysql2_promise = require_rolldown_runtime.__toESM(mysql2_promise, 1);
+//#region src/commands/db/create-readonly-user/mysql.js
+/**
+* @typedef {import("./utils.js").ConnectionConfig} ConnectionConfig
+*/
+/**
+* @param {ConnectionConfig} config
+* @returns {Promise<import("mysql2/promise").Connection>}
+*/
+async function createConnection(config) {
+	return mysql2_promise.default.createConnection({
+		host: config.host,
+		port: config.port,
+		user: config.user,
+		password: config.password,
+		database: config.database || void 0,
+		ssl: config.ssl && typeof config.ssl === "object" ? config.ssl : void 0,
+		multipleStatements: false
+	});
+}
+/**
+* List schemas/databases visible to the admin user (excluding system schemas).
+* @param {ConnectionConfig} config
+* @returns {Promise<string[]>}
+*/
+async function listMysqlDatabases(config) {
+	const connection = await createConnection(config);
+	try {
+		const [rows] = await connection.query("SHOW DATABASES");
+		return rows.map((row) => row.Database ?? "").filter((name) => Boolean(name)).filter((name) => !require_commands_db_create_readonly_user_utils.isSystemDatabase({
+			engine: "mysql",
+			name
+		})).sort((a, b) => a.localeCompare(b));
+	} finally {
+		await connection.end();
+	}
+}
+/**
+* Create/update a MySQL user and grant SELECT on one database or *.* .
+* @param {{
+*   config: ConnectionConfig;
+*   username: string;
+*   password: string;
+*   databases: string[] | "all";
+*   hostPattern: string;
+*   dryRun?: boolean;
+*   verbose?: boolean;
+* }} params
+* @returns {Promise<{ created: boolean; statements: string[]; databases: string[] | "all" }>}
+*/
+async function applyMysqlReadonly(params) {
+	const { config, username, password, databases, hostPattern, dryRun = false, verbose = false } = params;
+	const userLiteral = require_commands_db_create_readonly_user_utils.quoteLiteral(username);
+	const hostLiteral = require_commands_db_create_readonly_user_utils.quoteLiteral(hostPattern);
+	const passwordLiteral = require_commands_db_create_readonly_user_utils.quoteLiteral(password);
+	const account = `${userLiteral}@${hostLiteral}`;
+	/** @type {string[]} */
+	const statements = [];
+	const createSql = `CREATE USER IF NOT EXISTS ${account} IDENTIFIED BY ${passwordLiteral}`;
+	const alterSql = `ALTER USER ${account} IDENTIFIED BY ${passwordLiteral}`;
+	/** @type {string[]} */
+	const grantSqls = [];
+	if (databases === "all") grantSqls.push(`GRANT SELECT, SHOW VIEW, SHOW DATABASES ON *.* TO ${account}`);
+	else for (const database of databases) {
+		const dbIdent = require_commands_db_create_readonly_user_utils.quoteIdent({
+			engine: "mysql",
+			name: database
+		});
+		grantSqls.push(`GRANT SELECT, SHOW VIEW ON ${dbIdent}.* TO ${account}`);
+	}
+	const flushSql = "FLUSH PRIVILEGES";
+	statements.push(createSql, alterSql, ...grantSqls, flushSql);
+	if (dryRun) return {
+		created: true,
+		statements: statements.map((sql) => sql.includes("IDENTIFIED BY") ? sql.replace(/IDENTIFIED BY '.*'/, "IDENTIFIED BY ***") : sql),
+		databases
+	};
+	const connection = await createConnection(config);
+	try {
+		if (verbose) console.log(`   Connected to MySQL as ${config.user}@${config.host}`);
+		const [existingRows] = await connection.query("SELECT 1 AS ok FROM mysql.user WHERE User = ? AND Host = ? LIMIT 1", [username, hostPattern]);
+		const existed = Array.isArray(existingRows) && existingRows.length > 0;
+		await connection.query(createSql);
+		await connection.query(alterSql);
+		for (const grantSql of grantSqls) await connection.query(grantSql);
+		await connection.query(flushSql);
+		return {
+			created: !existed,
+			statements: statements.map((sql) => sql.includes("IDENTIFIED BY") ? sql.replace(/IDENTIFIED BY '.*'/, "IDENTIFIED BY ***") : sql),
+			databases
+		};
+	} finally {
+		await connection.end();
+	}
+}
+//#endregion
+exports.applyMysqlReadonly = applyMysqlReadonly;
+exports.listMysqlDatabases = listMysqlDatabases;

package/cjs/commands/db/create-readonly-user/mysql.d.ts

@@ -0,0 +1,33 @@
+/**
+ * List schemas/databases visible to the admin user (excluding system schemas).
+ * @param {ConnectionConfig} config
+ * @returns {Promise<string[]>}
+ */
+export function listMysqlDatabases(config: ConnectionConfig): Promise<string[]>;
+/**
+ * Create/update a MySQL user and grant SELECT on one database or *.* .
+ * @param {{
+ *   config: ConnectionConfig;
+ *   username: string;
+ *   password: string;
+ *   databases: string[] | "all";
+ *   hostPattern: string;
+ *   dryRun?: boolean;
+ *   verbose?: boolean;
+ * }} params
+ * @returns {Promise<{ created: boolean; statements: string[]; databases: string[] | "all" }>}
+ */
+export function applyMysqlReadonly(params: {
+    config: ConnectionConfig;
+    username: string;
+    password: string;
+    databases: string[] | "all";
+    hostPattern: string;
+    dryRun?: boolean;
+    verbose?: boolean;
+}): Promise<{
+    created: boolean;
+    statements: string[];
+    databases: string[] | "all";
+}>;
+export type ConnectionConfig = import("./utils.js").ConnectionConfig;

package/cjs/commands/db/create-readonly-user/postgres.cjs

@@ -0,0 +1,209 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_rolldown_runtime = require("../../../__chunks/VH7oDXx4.cjs");
+const require_commands_db_create_readonly_user_utils = require("./utils.cjs");
+let pg = require("pg");
+pg = require_rolldown_runtime.__toESM(pg, 1);
+//#region src/commands/db/create-readonly-user/postgres.js
+const { Client } = pg.default;
+/**
+* @typedef {import("./utils.js").ConnectionConfig} ConnectionConfig
+*/
+/**
+* @param {ConnectionConfig} config
+* @param {string} [database]
+* @returns {import("pg").Client}
+*/
+function createClient(config, database) {
+	return new Client({
+		host: config.host,
+		port: config.port,
+		user: config.user,
+		password: config.password,
+		database: database ?? (config.database || "postgres"),
+		ssl: config.ssl
+	});
+}
+/**
+* @param {import("pg").Client} client
+* @param {string} sql
+* @param {unknown[]} [params]
+*/
+async function query(client, sql, params) {
+	return client.query(sql, params);
+}
+/**
+* List non-template databases visible to the admin user.
+* @param {ConnectionConfig} config
+* @returns {Promise<string[]>}
+*/
+async function listPostgresDatabases(config) {
+	const client = createClient(config, config.database || "postgres");
+	await client.connect();
+	try {
+		return (await query(client, `SELECT datname
+       FROM pg_database
+       WHERE datistemplate = false
+       ORDER BY datname`)).rows.map((row) => row.datname).filter((name) => !require_commands_db_create_readonly_user_utils.isSystemDatabase({
+			engine: "postgres",
+			name
+		}));
+	} finally {
+		await client.end();
+	}
+}
+/**
+* Ensure a login role exists (create or update password).
+* @param {import("pg").Client} client
+* @param {{ username: string; password: string }} params
+* @returns {Promise<{ created: boolean; statements: string[] }>}
+*/
+async function ensureRole(client, params) {
+	const { username, password } = params;
+	const ident = require_commands_db_create_readonly_user_utils.quoteIdent({
+		engine: "postgres",
+		name: username
+	});
+	const passwordLiteral = require_commands_db_create_readonly_user_utils.quoteLiteral(password);
+	const existing = await query(client, "SELECT 1 FROM pg_roles WHERE rolname = $1", [username]);
+	/** @type {string[]} */
+	const statements = [];
+	if (existing.rowCount && existing.rowCount > 0) {
+		const sql = `ALTER ROLE ${ident} WITH LOGIN PASSWORD ${passwordLiteral}`;
+		statements.push(sql);
+		await query(client, sql);
+		return {
+			created: false,
+			statements
+		};
+	}
+	const sql = `CREATE ROLE ${ident} WITH LOGIN PASSWORD ${passwordLiteral}`;
+	statements.push(sql);
+	await query(client, sql);
+	return {
+		created: true,
+		statements
+	};
+}
+/**
+* Grant read-only privileges inside one database (schemas, tables, sequences, defaults).
+* @param {import("pg").Client} client
+* @param {{ username: string }} params
+* @returns {Promise<string[]>}
+*/
+async function grantReadonlyInDatabase(client, params) {
+	const { username } = params;
+	const ident = require_commands_db_create_readonly_user_utils.quoteIdent({
+		engine: "postgres",
+		name: username
+	});
+	/** @type {string[]} */
+	const statements = [];
+	const schemas = (await query(client, `SELECT nspname
+     FROM pg_namespace
+     WHERE nspname NOT IN ('pg_catalog', 'information_schema', 'pg_toast')
+       AND nspname NOT LIKE 'pg_temp_%'
+       AND nspname NOT LIKE 'pg_toast_temp_%'
+     ORDER BY nspname`)).rows.map((row) => row.nspname);
+	if (schemas.length === 0) schemas.push("public");
+	for (const schema of schemas) {
+		const schemaIdent = require_commands_db_create_readonly_user_utils.quoteIdent({
+			engine: "postgres",
+			name: schema
+		});
+		const grants = [
+			`GRANT USAGE ON SCHEMA ${schemaIdent} TO ${ident}`,
+			`GRANT SELECT ON ALL TABLES IN SCHEMA ${schemaIdent} TO ${ident}`,
+			`GRANT SELECT ON ALL SEQUENCES IN SCHEMA ${schemaIdent} TO ${ident}`,
+			`ALTER DEFAULT PRIVILEGES IN SCHEMA ${schemaIdent} GRANT SELECT ON TABLES TO ${ident}`,
+			`ALTER DEFAULT PRIVILEGES IN SCHEMA ${schemaIdent} GRANT SELECT ON SEQUENCES TO ${ident}`
+		];
+		for (const sql of grants) {
+			statements.push(sql);
+			await query(client, sql);
+		}
+	}
+	return statements;
+}
+/**
+* Create/update a Postgres role and grant read-only on one or all databases.
+* @param {{
+*   config: ConnectionConfig;
+*   username: string;
+*   password: string;
+*   databases: string[];
+*   dryRun?: boolean;
+*   verbose?: boolean;
+* }} params
+* @returns {Promise<{ created: boolean; statements: string[]; databases: string[] }>}
+*/
+async function applyPostgresReadonly(params) {
+	const { config, username, password, databases, dryRun = false, verbose = false } = params;
+	/** @type {string[]} */
+	const statements = [];
+	let created = false;
+	if (dryRun) {
+		const ident = require_commands_db_create_readonly_user_utils.quoteIdent({
+			engine: "postgres",
+			name: username
+		});
+		statements.push(`-- Would CREATE/ALTER ROLE ${ident} WITH LOGIN PASSWORD ***`);
+		for (const database of databases) {
+			const dbIdent = require_commands_db_create_readonly_user_utils.quoteIdent({
+				engine: "postgres",
+				name: database
+			});
+			statements.push(`GRANT CONNECT ON DATABASE ${dbIdent} TO ${ident}`);
+			statements.push(`-- In database ${database}: GRANT USAGE/SELECT on all user schemas + ALTER DEFAULT PRIVILEGES`);
+		}
+		return {
+			created: true,
+			statements,
+			databases
+		};
+	}
+	const adminDb = config.database || "postgres";
+	const adminClient = createClient(config, adminDb);
+	await adminClient.connect();
+	try {
+		if (verbose) console.log(`   Connected to Postgres as ${config.user}@${config.host}/${adminDb}`);
+		const roleResult = await ensureRole(adminClient, {
+			username,
+			password
+		});
+		created = roleResult.created;
+		statements.push(...roleResult.statements);
+		const ident = require_commands_db_create_readonly_user_utils.quoteIdent({
+			engine: "postgres",
+			name: username
+		});
+		for (const database of databases) {
+			const connectSql = `GRANT CONNECT ON DATABASE ${require_commands_db_create_readonly_user_utils.quoteIdent({
+				engine: "postgres",
+				name: database
+			})} TO ${ident}`;
+			statements.push(connectSql);
+			await query(adminClient, connectSql);
+		}
+	} finally {
+		await adminClient.end();
+	}
+	for (const database of databases) {
+		const dbClient = createClient(config, database);
+		await dbClient.connect();
+		try {
+			if (verbose) console.log(`   Granting read-only in database ${database}`);
+			const dbStatements = await grantReadonlyInDatabase(dbClient, { username });
+			statements.push(...dbStatements);
+		} finally {
+			await dbClient.end();
+		}
+	}
+	return {
+		created,
+		statements,
+		databases
+	};
+}
+//#endregion
+exports.applyPostgresReadonly = applyPostgresReadonly;
+exports.listPostgresDatabases = listPostgresDatabases;

package/cjs/commands/db/create-readonly-user/postgres.d.ts

@@ -0,0 +1,31 @@
+/**
+ * List non-template databases visible to the admin user.
+ * @param {ConnectionConfig} config
+ * @returns {Promise<string[]>}
+ */
+export function listPostgresDatabases(config: ConnectionConfig): Promise<string[]>;
+/**
+ * Create/update a Postgres role and grant read-only on one or all databases.
+ * @param {{
+ *   config: ConnectionConfig;
+ *   username: string;
+ *   password: string;
+ *   databases: string[];
+ *   dryRun?: boolean;
+ *   verbose?: boolean;
+ * }} params
+ * @returns {Promise<{ created: boolean; statements: string[]; databases: string[] }>}
+ */
+export function applyPostgresReadonly(params: {
+    config: ConnectionConfig;
+    username: string;
+    password: string;
+    databases: string[];
+    dryRun?: boolean;
+    verbose?: boolean;
+}): Promise<{
+    created: boolean;
+    statements: string[];
+    databases: string[];
+}>;
+export type ConnectionConfig = import("./utils.js").ConnectionConfig;