@naviyra/cloud-panel 0.0.3-beta → 0.0.3-beta3

package/apps/panel/lib/agent.mjs

@@ -9,16 +9,27 @@ export async function agent(route, options = {}) {
     throw Error("Remote agents require HTTPS");
   if ((process.env.AGENT_TOKEN?.length || 0) < 32)
     throw Error("Configure AGENT_TOKEN");
+  const { signal, raw, ...rest } = options;
   const response = await fetch(base + route, {
-    ...options,
+    ...rest,
     headers: {
       Authorization: `Bearer ${process.env.AGENT_TOKEN}`,
       "Content-Type": "application/json",
       ...options.headers,
     },
     cache: "no-store",
-    signal: AbortSignal.timeout(30000),
+    signal: signal ?? AbortSignal.timeout(30000),
   });
+  if (raw) {
+    if (!response.ok) {
+      const body = await response.json().catch(() => ({}));
+      throw Object.assign(Error(body.error || "Agent request failed"), {
+        status: response.status,
+      });
+    }
+    await db.query("UPDATE agents SET last_seen=now() WHERE name='primary'");
+    return response;
+  }
   const body = await response.json();
   if (!response.ok)
     throw Object.assign(Error(body.error || "Agent request failed"), {

package/apps/panel/lib/databases.mjs

@@ -124,6 +124,126 @@ function view(row, parts, password) {
   };
 }
 
+const DB_NAME = /^[a-zA-Z_][a-zA-Z0-9_]{0,62}$/;
+const SECRET = /password|passwd|token|secret|credential|api_key/i;
+
+function assertDbName(value) {
+  const name = String(value || "");
+  if (!DB_NAME.test(name)) throw fail("Database not found", 404);
+  return name;
+}
+
+function cell(value) {
+  if (value == null) return null;
+  if (typeof value === "number" || typeof value === "boolean") return value;
+  if (value instanceof Date) return value.toISOString();
+  if (Buffer.isBuffer(value)) return "[binary]";
+  const text =
+    typeof value === "object" ? JSON.stringify(value) : String(value);
+  return text.length > 500 ? `${text.slice(0, 500)}…` : text;
+}
+
+async function connectDatabase(name) {
+  const { url } = connectionParts();
+  const admin = new URL(url.href);
+  admin.pathname = `/${name}`;
+  const client = new pg.Client({ connectionString: admin.href });
+  await client.connect();
+  await client.query("SET statement_timeout = '15s'");
+  await client.query("SET default_transaction_read_only = on");
+  return client;
+}
+
+export async function listNativeDatabases() {
+  const parts = connectionParts();
+  const databases = await withAdmin(async (client) => {
+    const { rows } = await client.query(
+      `SELECT datname AS name, pg_database_size(datname)::bigint AS bytes
+       FROM pg_database
+       WHERE NOT datistemplate AND datname LIKE 'nv\\_%' ESCAPE '\\'
+       ORDER BY datname`,
+    );
+    return rows
+      .filter((row) => row.name !== parts.database)
+      .map((row) => ({ name: row.name, bytes: Number(row.bytes) }));
+  });
+  return { host: parts.host, port: parts.port, databases };
+}
+
+export async function browseNativeDatabase(database, table) {
+  const name = assertDbName(database);
+  if (!name.startsWith("nv_")) throw fail("Database not found", 404);
+  if (process.env.DATABASE_URL && name === connectionParts().database)
+    throw fail("Database not found", 404);
+  const exists = await withAdmin(async (client) => {
+    const found = await client.query(
+      "SELECT 1 FROM pg_database WHERE datname=$1 AND NOT datistemplate",
+      [name],
+    );
+    return found.rowCount > 0;
+  });
+  if (!exists) throw fail("Database not found", 404);
+  const client = await connectDatabase(name);
+  try {
+    const tables = (
+      await client.query(
+        `SELECT c.relname AS name
+         FROM pg_class c
+         JOIN pg_namespace n ON n.oid = c.relnamespace
+         WHERE n.nspname = 'public' AND c.relkind = 'r'
+         ORDER BY c.relname`,
+      )
+    ).rows.map((row) => row.name);
+    if (!table) return { database: name, tables, columns: [], rows: [] };
+    if (!DB_NAME.test(table) || !tables.includes(table))
+      throw fail("Table not found", 404);
+    const columns = (
+      await client.query(
+        `SELECT column_name, data_type
+         FROM information_schema.columns
+         WHERE table_schema = 'public' AND table_name = $1
+         ORDER BY ordinal_position`,
+        [table],
+      )
+    ).rows;
+    const statement = (
+      await client.query(
+        "SELECT format('SELECT * FROM %I LIMIT 50', $1::text) AS statement",
+        [table],
+      )
+    ).rows[0]?.statement;
+    const allowed = new Set([
+      `SELECT * FROM ${table} LIMIT 50`,
+      `SELECT * FROM "${table}" LIMIT 50`,
+    ]);
+    if (!allowed.has(statement)) throw fail("Could not read the table", 500);
+    const result = await client.query(statement);
+    const hidden = new Set(
+      columns
+        .filter((column) => SECRET.test(column.column_name))
+        .map((column) => column.column_name),
+    );
+    return {
+      database: name,
+      table,
+      tables,
+      columns: columns.map((column) => ({
+        name: column.column_name,
+        type: column.data_type,
+        hidden: hidden.has(column.column_name),
+      })),
+      rows: result.rows.map((row) => {
+        const out = {};
+        for (const [key, value] of Object.entries(row))
+          out[key] = hidden.has(key) ? "[hidden]" : cell(value);
+        return out;
+      }),
+    };
+  } finally {
+    await client.end();
+  }
+}
+
 export async function listDatabases(userId) {
   const rows = (
     await db.query(

package/apps/panel/lib/request-origin.mjs

@@ -0,0 +1,29 @@
+const LOOPBACK = new Set(["localhost", "127.0.0.1", "::1"]);
+
+function parseOrigin(value) {
+  if (!value || typeof value !== "string") return null;
+  try {
+    const url = new URL(value);
+    if (url.origin === "null") return null;
+    return url;
+  } catch {
+    return null;
+  }
+}
+
+function hostname(url) {
+  return url.hostname.replace(/^\[|\]$/g, "");
+}
+
+function sameSite(left, right) {
+  if (left.origin === right.origin) return true;
+  if (left.protocol !== right.protocol || left.port !== right.port) return false;
+  return LOOPBACK.has(hostname(left)) && LOOPBACK.has(hostname(right));
+}
+
+export function originAllowed(originHeader, expected) {
+  const origin = parseOrigin(originHeader);
+  const target = parseOrigin(expected);
+  if (!origin || !target) return false;
+  return sameSite(origin, target);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@naviyra/cloud-panel",
-  "version": "0.0.3-beta",
+  "version": "0.0.3-beta3",
   "description": "Self-hosted Naviyra panel for projects, databases, DNS, and email routing.",
   "type": "module",
   "bin": {

package/packages/shared/index.mjs

@@ -14,6 +14,31 @@ const relativePath = z
     /^(?!\/)(?!.*(?:^|\/)\.\.(?:\/|$))[a-zA-Z0-9_./-]+$/,
     "Use a relative project path without ..",
   );
+const optionalPath = z.union([z.literal(""), relativePath]);
+export const reservedEnv = new Set([
+  "PATH",
+  "NODE_OPTIONS",
+  "NODE_PATH",
+  "LD_PRELOAD",
+  "LD_LIBRARY_PATH",
+  "DYLD_INSERT_LIBRARIES",
+  "HOME",
+  "USERPROFILE",
+  "SYSTEMROOT",
+  "WINDIR",
+  "COMSPEC",
+  "PATHEXT",
+  "TEMP",
+  "TMP",
+  "APPDATA",
+  "LOCALAPPDATA",
+  "PORT",
+  "HOST",
+  "HOSTNAME",
+  "NODE_ENV",
+  "GIT_TERMINAL_PROMPT",
+  "PYTHONUNBUFFERED",
+]);
 export const runtimeConfig = z
   .object({
     python_server: z.enum(["asgi", "wsgi"]).default("asgi"),
@@ -28,6 +53,27 @@ export const runtimeConfig = z
       .regex(/^[a-zA-Z0-9_.-]*$/)
       .default(""),
     args: z.array(z.string().max(1000)).max(32).default([]),
+    startup_file: optionalPath.default(""),
+    working_dir: relativePath.default("."),
+    env: z
+      .record(
+        z.string().regex(/^[A-Za-z_][A-Za-z0-9_]{0,63}$/),
+        z.string().max(500),
+      )
+      .refine((value) => Object.keys(value).length <= 30, {
+        message: "Use at most 30 environment variables",
+      })
+      .default({}),
+  })
+  .superRefine((config, ctx) => {
+    for (const key of Object.keys(config.env || {})) {
+      if (reservedEnv.has(key.toUpperCase()) || key === "Path")
+        ctx.addIssue({
+          code: "custom",
+          path: ["env", key],
+          message: `${key} is reserved and cannot be set here`,
+        });
+    }
   })
   .default({
     python_server: "asgi",
@@ -35,6 +81,9 @@ export const runtimeConfig = z
     public_dir: ".",
     executable: "",
     args: [],
+    startup_file: "",
+    working_dir: ".",
+    env: {},
   });
 export const projectInput = z
   .object({