@mtndev/cli 2.0.0 → 2.0.1

package/cjs/commands/aws/utils/tty.cjs

@@ -1,10 +1,54 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true});
-
-
-
-var _CMUD7LLNcjs = require('../../../__chunks/CMUD7LLN.cjs');
-
-
-
-
-exports.prompt = _CMUD7LLNcjs.prompt; exports.promptChoice = _CMUD7LLNcjs.promptChoice; exports.promptYesNo = _CMUD7LLNcjs.promptYesNo;
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+let readline = require("readline");
+//#region src/commands/aws/utils/tty.js
+/**
+* Prompt for a single line of input.
+* @param {string} message - Prompt text shown to the user
+* @returns {Promise<string>}
+*/
+function prompt(message) {
+	return new Promise((resolve) => {
+		const rl = (0, readline.createInterface)({
+			input: process.stdin,
+			output: process.stdout
+		});
+		rl.question(message, (answer) => {
+			rl.close();
+			resolve(answer.trim());
+		});
+	});
+}
+/**
+* Prompt the user to pick one option from a numbered list.
+* @param {{ message: string; options: string[] }} params
+* @returns {Promise<number>} Zero-based index of the chosen option
+*/
+async function promptChoice(params) {
+	const { message, options } = params;
+	if (options.length === 0) throw new Error("promptChoice: no options to choose from");
+	console.log(message);
+	options.forEach((option, index) => {
+		console.log(`  ${index + 1}. ${option}`);
+	});
+	for (;;) {
+		const raw = await prompt("Enter number: ");
+		const choice = Number.parseInt(raw, 10);
+		if (Number.isInteger(choice) && choice >= 1 && choice <= options.length) return choice - 1;
+		console.log(`Please enter a number between 1 and ${options.length}.`);
+	}
+}
+/**
+* Prompt a yes/no question.
+* @param {{ message: string; defaultYes?: boolean }} params
+* @returns {Promise<boolean>}
+*/
+async function promptYesNo(params) {
+	const { message, defaultYes = false } = params;
+	const answer = (await prompt(`${message}${defaultYes ? " [Y/n]: " : " [y/N]: "}`)).toLowerCase();
+	if (answer === "") return defaultYes;
+	return answer === "y" || answer === "yes";
+}
+//#endregion
+exports.prompt = prompt;
+exports.promptChoice = promptChoice;
+exports.promptYesNo = promptYesNo;

package/cjs/commands/db/create-readonly-user/handler.cjs

@@ -1,11 +1,254 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true});
-
-var _LXDF5QVZcjs = require('../../../__chunks/LXDF5QVZ.cjs');
-require('../../../__chunks/3A5ZYU5M.cjs');
-require('../../../__chunks/K4QNHRTP.cjs');
-require('../../../__chunks/H74JSDBU.cjs');
-require('../../../__chunks/NWZGFHKH.cjs');
-require('../../../__chunks/CMUD7LLN.cjs');
-
-
-exports.createReadonlyUserCommand = _LXDF5QVZcjs.createReadonlyUserCommand;
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_rolldown_runtime = require("../../../__chunks/VH7oDXx4.cjs");
+const require_commands_aws_utils_tty = require("../../aws/utils/tty.cjs");
+const require_commands_db_create_readonly_user_utils = require("./utils.cjs");
+const require_commands_db_create_readonly_user_mysql = require("./mysql.cjs");
+const require_commands_db_create_readonly_user_postgres = require("./postgres.cjs");
+const require_commands_db_create_readonly_user_schema = require("./schema.cjs");
+let chalk = require("chalk");
+chalk = require_rolldown_runtime.__toESM(chalk, 1);
+let zod = require("zod");
+//#region src/commands/db/create-readonly-user/handler.js
+/**
+* @param {"postgres" | "mysql" | undefined} engineOption
+* @param {string | null} url
+* @returns {Promise<"postgres" | "mysql">}
+*/
+async function resolveEngine(engineOption, url) {
+	if (engineOption) return engineOption;
+	if (url) {
+		const detected = require_commands_db_create_readonly_user_utils.detectEngineFromUrl(url);
+		if (detected) return detected;
+	}
+	const index = await require_commands_aws_utils_tty.promptChoice({
+		message: "Choose a database engine:",
+		options: ["postgres", "mysql"]
+	});
+	const chosen = require_commands_db_create_readonly_user_schema.ENGINES[index];
+	if (!chosen) throw new Error("No engine selected");
+	return chosen;
+}
+/**
+* @param {{ urlOption?: string; engine: "postgres" | "mysql" }} params
+* @returns {Promise<string>}
+*/
+async function resolveUrl(params) {
+	const { urlOption, engine } = params;
+	const fromEnv = require_commands_db_create_readonly_user_utils.resolveAdminUrl({
+		url: urlOption,
+		engine
+	});
+	if (fromEnv) return fromEnv;
+	const raw = await require_commands_aws_utils_tty.prompt(`  Admin connection URL (e.g. ${engine === "postgres" ? "postgresql://admin:pass@host:5432/postgres" : "mysql://admin:pass@host:3306/"}): `);
+	if (!raw) throw new Error("Admin connection URL is required (pass --url or set DATABASE_URL)");
+	return raw;
+}
+/**
+* @param {{
+*   databaseOption?: string;
+*   databases: string[];
+* }} params
+* @returns {Promise<{ mode: "all" | "one"; databases: string[] }>}
+*/
+async function resolveScope(params) {
+	const { databaseOption, databases } = params;
+	if (databaseOption) {
+		const normalized = databaseOption.trim().toLowerCase();
+		if (normalized === "all" || normalized === "*") return {
+			mode: "all",
+			databases
+		};
+		if (!databases.includes(databaseOption)) throw new Error(`Database "${databaseOption}" not found. Available: ${databases.join(", ") || "(none)"}`);
+		return {
+			mode: "one",
+			databases: [databaseOption]
+		};
+	}
+	if (databases.length === 0) throw new Error("No user databases found to grant access on.");
+	const options = [...databases.map((name) => name), `all (${databases.length} databases)`];
+	const index = await require_commands_aws_utils_tty.promptChoice({
+		message: "Grant read-only on which database?",
+		options
+	});
+	if (index === options.length - 1) return {
+		mode: "all",
+		databases
+	};
+	const chosen = databases[index];
+	if (!chosen) throw new Error("No database selected");
+	return {
+		mode: "one",
+		databases: [chosen]
+	};
+}
+/**
+* @param {string | undefined} usernameOption
+* @returns {Promise<string>}
+*/
+async function resolveUsername(usernameOption) {
+	if (usernameOption) return usernameOption;
+	const username = await require_commands_aws_utils_tty.prompt(`  Read-only username [default: readonly]: `) || "readonly";
+	if (!/^[A-Za-z0-9_]+$/.test(username)) throw new Error("Username must contain only letters, numbers, and underscores");
+	return username;
+}
+/**
+* @param {string | undefined} passwordOption
+* @returns {Promise<{ password: string; generated: boolean }>}
+*/
+async function resolvePassword(passwordOption) {
+	if (passwordOption) return {
+		password: passwordOption,
+		generated: false
+	};
+	if (await require_commands_aws_utils_tty.promptYesNo({
+		message: "  Generate a random password?",
+		defaultYes: true
+	})) return {
+		password: require_commands_db_create_readonly_user_utils.generatePassword(),
+		generated: true
+	};
+	const password = await require_commands_aws_utils_tty.prompt("  Password: ");
+	if (!password) throw new Error("Password is required");
+	return {
+		password,
+		generated: false
+	};
+}
+/**
+* Redact password in a URL for display.
+* @param {string} url
+* @returns {string}
+*/
+function redactUrl(url) {
+	try {
+		const parsed = new URL(url);
+		if (parsed.password) parsed.password = "***";
+		return parsed.toString();
+	} catch {
+		return url;
+	}
+}
+/**
+* `db create-readonly-user` handler.
+* @param {unknown} options
+*/
+async function createReadonlyUserCommand(options) {
+	try {
+		const { engine: engineOption, url: urlOption, database: databaseOption, username: usernameOption, password: passwordOption, hostPattern: hostPatternOption, ssl: sslOption, yes, dryRun, verbose } = require_commands_db_create_readonly_user_schema.createReadonlyUserOptionsSchema.parse(options);
+		console.log(chalk.default.blue("\nCreate read-only database user"));
+		console.log("");
+		const engine = await resolveEngine(engineOption, require_commands_db_create_readonly_user_utils.resolveAdminUrl({
+			url: urlOption,
+			engine: engineOption
+		}));
+		console.log(`Engine: ${engine}`);
+		const url = await resolveUrl({
+			urlOption,
+			engine
+		});
+		const config = require_commands_db_create_readonly_user_utils.parseConnectionUrl({
+			url,
+			engine,
+			sslOption
+		});
+		console.log(`Admin:  ${config.user}@${config.host}:${config.port}` + (config.database ? `/${config.database}` : ""));
+		console.log("");
+		const listed = engine === "postgres" ? await require_commands_db_create_readonly_user_postgres.listPostgresDatabases(config) : await require_commands_db_create_readonly_user_mysql.listMysqlDatabases(config);
+		if (verbose) {
+			console.log(`Found databases: ${listed.join(", ") || "(none)"}`);
+			console.log("");
+		}
+		const scope = await resolveScope({
+			databaseOption,
+			databases: listed
+		});
+		console.log(scope.mode === "all" ? `Scope:  all (${scope.databases.length} databases)` : `Scope:  ${scope.databases[0]}`);
+		console.log("");
+		const username = await resolveUsername(usernameOption);
+		const { password, generated } = await resolvePassword(passwordOption);
+		const hostPattern = hostPatternOption ?? "%";
+		console.log("");
+		console.log("Plan:");
+		console.log(`  User:     ${username}`);
+		console.log(`  Password: ${generated ? "(generated)" : "(provided)"}${dryRun ? " [dry-run]" : ""}`);
+		if (engine === "mysql") console.log(`  Host:     ${hostPattern}`);
+		console.log(scope.mode === "all" ? `  Grants:   SELECT on ALL databases (${scope.databases.length})` : `  Grants:   SELECT on ${scope.databases[0]}`);
+		if (scope.mode === "all" && engine === "postgres") console.log(chalk.default.yellow("  Note:     Databases created later will NOT get these grants automatically — re-run this command."));
+		console.log("");
+		if (!yes && !dryRun) {
+			if (!await require_commands_aws_utils_tty.promptYesNo({
+				message: "Apply these changes?",
+				defaultYes: false
+			})) {
+				console.log("Aborted.");
+				return;
+			}
+			console.log("");
+		}
+		const result = engine === "postgres" ? await require_commands_db_create_readonly_user_postgres.applyPostgresReadonly({
+			config,
+			username,
+			password,
+			databases: scope.databases,
+			dryRun,
+			verbose
+		}) : await require_commands_db_create_readonly_user_mysql.applyMysqlReadonly({
+			config,
+			username,
+			password,
+			databases: scope.mode === "all" ? "all" : scope.databases,
+			hostPattern,
+			dryRun,
+			verbose
+		});
+		if (dryRun) {
+			console.log(chalk.default.cyan("Dry run — SQL that would run:"));
+			for (const statement of result.statements) console.log(`  ${statement}`);
+			console.log("");
+			console.log(chalk.default.cyan("No changes made."));
+			return;
+		}
+		console.log(chalk.default.green(result.created ? `Created user "${username}" and granted read-only access.` : `Updated user "${username}" password and refreshed read-only grants.`));
+		console.log("");
+		const sampleDb = scope.mode === "one" ? scope.databases[0] ?? "" : scope.databases[0] ?? "";
+		const readonlyUrl = require_commands_db_create_readonly_user_utils.buildReadonlyUrl({
+			engine,
+			host: config.host,
+			port: config.port,
+			username,
+			password,
+			database: sampleDb
+		});
+		console.log("Connection (secret shown once — copy now):");
+		console.log("────────────────────────────────────────────────────────────────");
+		console.log(readonlyUrl);
+		if (scope.mode === "all") {
+			console.log("");
+			console.log(chalk.default.gray(`  (URL uses database "${sampleDb}" as an example; user can connect to any granted database.)`));
+		}
+		console.log("────────────────────────────────────────────────────────────────");
+		console.log("");
+		console.log(chalk.default.gray(`Admin URL used: ${redactUrl(url)}`));
+	} catch (error) {
+		if (error instanceof zod.ZodError) {
+			console.error(chalk.default.red("\n❌ Invalid command options:"));
+			error.errors.forEach((err) => {
+				console.error(chalk.default.red(`   ${err.path.join(".")}: ${err.message}`));
+			});
+			process.exit(1);
+		}
+		const verbose = options?.verbose || false;
+		console.error(chalk.default.red("\n❌ create-readonly-user failed:"));
+		if (error instanceof Error) {
+			console.error(chalk.default.red(`   ${error.message}`));
+			if (verbose && error.stack) {
+				console.error(chalk.default.gray("\nStack trace:"));
+				console.error(chalk.default.gray(error.stack));
+			}
+		} else console.error(chalk.default.red(`   ${String(error)}`));
+		console.error(chalk.default.yellow("\n💡 Pass --url or set DATABASE_URL. Use --verbose for details.\n"));
+		process.exit(1);
+	}
+}
+//#endregion
+exports.createReadonlyUserCommand = createReadonlyUserCommand;

package/cjs/commands/db/create-readonly-user/index.cjs

@@ -1,40 +1,18 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true});require('../../../__chunks/W6K7BV74.cjs');
-
-
-var _LXDF5QVZcjs = require('../../../__chunks/LXDF5QVZ.cjs');
-require('../../../__chunks/3A5ZYU5M.cjs');
-require('../../../__chunks/K4QNHRTP.cjs');
-
-
-
-
-
-var _H74JSDBUcjs = require('../../../__chunks/H74JSDBU.cjs');
-
-
-
-
-
-
-
-
-
-
-var _NWZGFHKHcjs = require('../../../__chunks/NWZGFHKH.cjs');
-require('../../../__chunks/CMUD7LLN.cjs');
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-exports.DEFAULT_MYSQL_HOST_PATTERN = _H74JSDBUcjs.DEFAULT_MYSQL_HOST_PATTERN; exports.DEFAULT_READONLY_USERNAME = _H74JSDBUcjs.DEFAULT_READONLY_USERNAME; exports.ENGINES = _H74JSDBUcjs.ENGINES; exports.buildReadonlyUrl = _NWZGFHKHcjs.buildReadonlyUrl; exports.createReadonlyUserCommand = _LXDF5QVZcjs.createReadonlyUserCommand; exports.createReadonlyUserOptionsSchema = _H74JSDBUcjs.createReadonlyUserOptionsSchema; exports.detectEngineFromUrl = _NWZGFHKHcjs.detectEngineFromUrl; exports.generatePassword = _NWZGFHKHcjs.generatePassword; exports.isSystemDatabase = _NWZGFHKHcjs.isSystemDatabase; exports.parseConnectionUrl = _NWZGFHKHcjs.parseConnectionUrl; exports.quoteIdent = _NWZGFHKHcjs.quoteIdent; exports.quoteLiteral = _NWZGFHKHcjs.quoteLiteral; exports.resolveAdminUrl = _NWZGFHKHcjs.resolveAdminUrl; exports.resolveSsl = _NWZGFHKHcjs.resolveSsl;
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_commands_db_create_readonly_user_utils = require("./utils.cjs");
+const require_commands_db_create_readonly_user_schema = require("./schema.cjs");
+const require_commands_db_create_readonly_user_handler = require("./handler.cjs");
+exports.DEFAULT_MYSQL_HOST_PATTERN = require_commands_db_create_readonly_user_schema.DEFAULT_MYSQL_HOST_PATTERN;
+exports.DEFAULT_READONLY_USERNAME = require_commands_db_create_readonly_user_schema.DEFAULT_READONLY_USERNAME;
+exports.ENGINES = require_commands_db_create_readonly_user_schema.ENGINES;
+exports.buildReadonlyUrl = require_commands_db_create_readonly_user_utils.buildReadonlyUrl;
+exports.createReadonlyUserCommand = require_commands_db_create_readonly_user_handler.createReadonlyUserCommand;
+exports.createReadonlyUserOptionsSchema = require_commands_db_create_readonly_user_schema.createReadonlyUserOptionsSchema;
+exports.detectEngineFromUrl = require_commands_db_create_readonly_user_utils.detectEngineFromUrl;
+exports.generatePassword = require_commands_db_create_readonly_user_utils.generatePassword;
+exports.isSystemDatabase = require_commands_db_create_readonly_user_utils.isSystemDatabase;
+exports.parseConnectionUrl = require_commands_db_create_readonly_user_utils.parseConnectionUrl;
+exports.quoteIdent = require_commands_db_create_readonly_user_utils.quoteIdent;
+exports.quoteLiteral = require_commands_db_create_readonly_user_utils.quoteLiteral;
+exports.resolveAdminUrl = require_commands_db_create_readonly_user_utils.resolveAdminUrl;
+exports.resolveSsl = require_commands_db_create_readonly_user_utils.resolveSsl;

package/cjs/commands/db/create-readonly-user/mysql.cjs

@@ -1,9 +1,102 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true});
-
-
-var _3A5ZYU5Mcjs = require('../../../__chunks/3A5ZYU5M.cjs');
-require('../../../__chunks/NWZGFHKH.cjs');
-
-
-
-exports.applyMysqlReadonly = _3A5ZYU5Mcjs.applyMysqlReadonly; exports.listMysqlDatabases = _3A5ZYU5Mcjs.listMysqlDatabases;
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_rolldown_runtime = require("../../../__chunks/VH7oDXx4.cjs");
+const require_commands_db_create_readonly_user_utils = require("./utils.cjs");
+let mysql2_promise = require("mysql2/promise");
+mysql2_promise = require_rolldown_runtime.__toESM(mysql2_promise, 1);
+//#region src/commands/db/create-readonly-user/mysql.js
+/**
+* @typedef {import("./utils.js").ConnectionConfig} ConnectionConfig
+*/
+/**
+* @param {ConnectionConfig} config
+* @returns {Promise<import("mysql2/promise").Connection>}
+*/
+async function createConnection(config) {
+	return mysql2_promise.default.createConnection({
+		host: config.host,
+		port: config.port,
+		user: config.user,
+		password: config.password,
+		database: config.database || void 0,
+		ssl: config.ssl && typeof config.ssl === "object" ? config.ssl : void 0,
+		multipleStatements: false
+	});
+}
+/**
+* List schemas/databases visible to the admin user (excluding system schemas).
+* @param {ConnectionConfig} config
+* @returns {Promise<string[]>}
+*/
+async function listMysqlDatabases(config) {
+	const connection = await createConnection(config);
+	try {
+		const [rows] = await connection.query("SHOW DATABASES");
+		return rows.map((row) => row.Database ?? "").filter((name) => Boolean(name)).filter((name) => !require_commands_db_create_readonly_user_utils.isSystemDatabase({
+			engine: "mysql",
+			name
+		})).sort((a, b) => a.localeCompare(b));
+	} finally {
+		await connection.end();
+	}
+}
+/**
+* Create/update a MySQL user and grant SELECT on one database or *.* .
+* @param {{
+*   config: ConnectionConfig;
+*   username: string;
+*   password: string;
+*   databases: string[] | "all";
+*   hostPattern: string;
+*   dryRun?: boolean;
+*   verbose?: boolean;
+* }} params
+* @returns {Promise<{ created: boolean; statements: string[]; databases: string[] | "all" }>}
+*/
+async function applyMysqlReadonly(params) {
+	const { config, username, password, databases, hostPattern, dryRun = false, verbose = false } = params;
+	const userLiteral = require_commands_db_create_readonly_user_utils.quoteLiteral(username);
+	const hostLiteral = require_commands_db_create_readonly_user_utils.quoteLiteral(hostPattern);
+	const passwordLiteral = require_commands_db_create_readonly_user_utils.quoteLiteral(password);
+	const account = `${userLiteral}@${hostLiteral}`;
+	/** @type {string[]} */
+	const statements = [];
+	const createSql = `CREATE USER IF NOT EXISTS ${account} IDENTIFIED BY ${passwordLiteral}`;
+	const alterSql = `ALTER USER ${account} IDENTIFIED BY ${passwordLiteral}`;
+	/** @type {string[]} */
+	const grantSqls = [];
+	if (databases === "all") grantSqls.push(`GRANT SELECT, SHOW VIEW, SHOW DATABASES ON *.* TO ${account}`);
+	else for (const database of databases) {
+		const dbIdent = require_commands_db_create_readonly_user_utils.quoteIdent({
+			engine: "mysql",
+			name: database
+		});
+		grantSqls.push(`GRANT SELECT, SHOW VIEW ON ${dbIdent}.* TO ${account}`);
+	}
+	const flushSql = "FLUSH PRIVILEGES";
+	statements.push(createSql, alterSql, ...grantSqls, flushSql);
+	if (dryRun) return {
+		created: true,
+		statements: statements.map((sql) => sql.includes("IDENTIFIED BY") ? sql.replace(/IDENTIFIED BY '.*'/, "IDENTIFIED BY ***") : sql),
+		databases
+	};
+	const connection = await createConnection(config);
+	try {
+		if (verbose) console.log(`   Connected to MySQL as ${config.user}@${config.host}`);
+		const [existingRows] = await connection.query("SELECT 1 AS ok FROM mysql.user WHERE User = ? AND Host = ? LIMIT 1", [username, hostPattern]);
+		const existed = Array.isArray(existingRows) && existingRows.length > 0;
+		await connection.query(createSql);
+		await connection.query(alterSql);
+		for (const grantSql of grantSqls) await connection.query(grantSql);
+		await connection.query(flushSql);
+		return {
+			created: !existed,
+			statements: statements.map((sql) => sql.includes("IDENTIFIED BY") ? sql.replace(/IDENTIFIED BY '.*'/, "IDENTIFIED BY ***") : sql),
+			databases
+		};
+	} finally {
+		await connection.end();
+	}
+}
+//#endregion
+exports.applyMysqlReadonly = applyMysqlReadonly;
+exports.listMysqlDatabases = listMysqlDatabases;