@onequery/cli 0.1.63-win32-x64 → 0.1.64-darwin-arm64

package/package.json

@@ -1,6 +1,6 @@
 {
   "cpu": [
-    "x64"
+    "arm64"
   ],
   "bugs": {
     "url": "https://github.com/wordbricks/onequery/issues"
@@ -14,7 +14,7 @@
   "license": "Apache-2.0",
   "name": "@onequery/cli",
   "os": [
-    "win32"
+    "darwin"
   ],
   "publishConfig": {
     "access": "public"
@@ -24,5 +24,5 @@
     "url": "git+https://github.com/wordbricks/onequery.git",
     "directory": "apps/cli"
   },
-  "version": "0.1.63-win32-x64"
+  "version": "0.1.64-darwin-arm64"
 }

package/vendor/{x86_64-pc-windows-msvc → aarch64-apple-darwin}/server/onequery-server.mjs

@@ -117276,6 +117276,7 @@ const AUTH_SESSION_EXPIRES_IN_DAYS = AUTH_SESSION_REFRESH_INTERVAL_DAYS + 1;
 const AUTH_SESSION_UPDATE_AGE_SECONDS = AUTH_SESSION_REFRESH_INTERVAL_DAYS * SECONDS_PER_DAY;
 const AUTH_SESSION_EXPIRES_IN_SECONDS = AUTH_SESSION_EXPIRES_IN_DAYS * SECONDS_PER_DAY;
 const AUTH_SESSION_COOKIE_CACHE_MAX_AGE_SECONDS = 15 * SECONDS_PER_MINUTE;
+const authOrganizationAccessControl = organizationAccessControl;
 function resolveAuthDb(config) {
 	if (config.db) return config.db;
 	if (config.databaseUrl) return createDb(config.databaseUrl);
@@ -117332,7 +117333,7 @@ function createAuth(config) {
 				verificationUri: "/api/device"
 			}),
 			organization({
-				ac: organizationAccessControl,
+				ac: authOrganizationAccessControl,
 				allowUserToCreateOrganization: true,
 				disableOrganizationDeletion: true,
 				invitationExpiresIn: ORGANIZATION_INVITATION_EXPIRES_IN_SECONDS,
@@ -128040,26 +128041,36 @@ function extractParsedQuery(statements, context) {
 		statement,
 		statementKind: "query"
 	});
-	if (isTopLevelShowExpression(statement, context)) return G$5.ok({
+	const metadataStatement = findReadOnlyMetadataStatement(statement, context);
+	if (metadataStatement) return G$5.ok({
 		statement,
-		statementKind: "show"
+		statementKind: metadataStatement.statementKind
 	});
-	const kind = getDeepestExpressionKind(statement);
-	return invalid("non_select_query", ERRORS.nonReadOnlyQuery(kind ?? "unknown"));
+	return invalid("non_select_query", buildNonReadOnlyQueryError(context, getDeepestExpressionKind(statement) ?? "unknown"));
 }
-function validateReadOnlyQuery(parsedQuery, dbType) {
+function validateReadOnlyQuery(parsedQuery, context) {
 	const cteViolation = findCteViolation(parsedQuery.statement);
 	if (cteViolation) return invalid("cte_must_select", cteViolation);
-	const selectIntoViolation = findSelectIntoViolationInQuery(parsedQuery.statement, dbType);
+	const selectIntoViolation = findSelectIntoViolationInQuery(parsedQuery.statement, context.dbType);
 	if (selectIntoViolation) return invalid("select_into_not_allowed", selectIntoViolation);
 	const lockingViolation = findLockingViolation(parsedQuery.statement);
 	if (lockingViolation) return invalid("locking_not_allowed", lockingViolation);
-	const unsafeFunctionViolation = findUnsafeFunctionViolation(parsedQuery.statement, dbType);
+	const unsafeFunctionViolation = findUnsafeFunctionViolation(parsedQuery.statement, context.dbType);
 	if (unsafeFunctionViolation) return invalid("unsafe_function", unsafeFunctionViolation);
 	const mutableKind = findSideEffectingExpressionKind(parsedQuery);
-	if (mutableKind) return invalid("non_select_query", ERRORS.nonReadOnlyQuery(mutableKind));
+	if (mutableKind) return invalid("non_select_query", buildNonReadOnlyQueryError(context, mutableKind));
 	return G$5.ok(null);
 }
+function buildNonReadOnlyQueryError(context, kind) {
+	return `Only ${formatAllowedStatementList(getAllowedStatementDisplayNames(context))} queries are allowed. Got: ${kind}`;
+}
+function getAllowedStatementDisplayNames(context) {
+	return ["SELECT", ...getAllowedMetadataStatementDefinitions(context).map((definition) => definition.displayName)];
+}
+function formatAllowedStatementList(names) {
+	if (names.length <= 2) return names.join(" or ");
+	return `${names.slice(0, -1).join(", ")}, or ${names.at(-1)}`;
+}
 function finalizeSql(context) {
 	return G$5.ok({ sql: context.trimmedSql });
 }
@@ -128095,15 +128106,24 @@ function unwrapParenthesizedQuery(expr) {
 function isTopLevelQueryExpression(expr) {
 	return index$1.isSelect(expr) || index$1.isSetOperation(expr);
 }
-function isTopLevelShowExpression(expr, context) {
-	const kind = getExpressionKind(expr);
-	if (kind === "show") return true;
-	return kind === "command" && firstTokenIs(context, "show");
+function findReadOnlyMetadataStatement(expr, context) {
+	const expressionKind = getExpressionKind(expr);
+	const firstKeyword = readFirstKeyword(context);
+	if (!firstKeyword) return null;
+	return getAllowedMetadataStatementDefinitions(context).find((definition) => {
+		if (!definition.firstKeywords.includes(firstKeyword)) return false;
+		if (definition.expressionKinds.includes(expressionKind)) return true;
+		return definition.allowOpaqueCommand && expressionKind === "command";
+	}) ?? null;
 }
-function firstTokenIs(context, keyword) {
+function getAllowedMetadataStatementDefinitions(context) {
+	return READ_ONLY_METADATA_STATEMENT_OVERRIDES[context.dbType] ?? DEFAULT_READ_ONLY_METADATA_STATEMENTS;
+}
+function readFirstKeyword(context) {
 	const tokenization = tokenize(context.trimmedSql, context.dialect);
-	if (!tokenization.success || !Array.isArray(tokenization.tokens)) return false;
-	return normalizeTokenText(tokenization.tokens.find((token) => normalizeTokenText(token).length > 0)) === keyword;
+	if (!tokenization.success || !Array.isArray(tokenization.tokens)) return null;
+	const keyword = normalizeTokenText(tokenization.tokens.find((token) => normalizeTokenText(token).length > 0));
+	return keyword.length > 0 ? keyword : null;
 }
 function isCteQueryExpression(expr) {
 	const unwrapped = unwrapParenthesizedQuery(expr);
@@ -128157,7 +128177,7 @@ function normalizeIdentifierName(value) {
 	return functionName.length > 0 ? functionName : null;
 }
 function isUnsafeFunctionName(functionName, dbType) {
-	if (dbType === "postgres") return POSTGRES_UNSAFE_FUNCTIONS.has(functionName) || functionName.startsWith("dblink_") || functionName.startsWith("pg_advisory_");
+	if (dbType === "postgres" || dbType === "motherduck") return POSTGRES_UNSAFE_FUNCTIONS.has(functionName) || functionName.startsWith("dblink_") || functionName.startsWith("pg_advisory_");
 	if (dbType === "mysql") return MYSQL_UNSAFE_FUNCTIONS.has(functionName);
 	if (dbType === "snowflake") return SNOWFLAKE_UNSAFE_FUNCTIONS.has(functionName) || functionName.startsWith("system$");
 	return false;
@@ -128167,7 +128187,7 @@ function findSideEffectingExpressionKind(parsedQuery) {
 	return mutableExpression ? getExpressionKind(mutableExpression) : null;
 }
 function isAllowedStatementRoot(expr, parsedQuery) {
-	return parsedQuery.statementKind === "show" && expr === parsedQuery.statement;
+	return parsedQuery.statementKind !== "query" && expr === parsedQuery.statement;
 }
 function isSideEffectingExpression(expr) {
 	return index$1.isInsert(expr) || index$1.isUpdate(expr) || index$1.isDelete(expr) || index$1.isDDL(expr) || SIDE_EFFECTING_EXPRESSION_KINDS.has(getExpressionKind(expr));
@@ -128198,18 +128218,17 @@ async function validateAndNormalizeReadOnlyQuery(sql, dbType) {
 		const context = yield* buildContext(sql, dbType);
 		yield* G$5.await(initSqlParser());
 		yield* validateStrictSyntax(context);
-		yield* validateReadOnlyQuery(yield* extractParsedQuery(yield* G$5.await(parseStatements(context)), context), context.dbType);
+		yield* validateReadOnlyQuery(yield* extractParsedQuery(yield* G$5.await(parseStatements(context)), context), context);
 		return finalizeSql(context);
 	});
 }
-var OUTFILE_ERROR, ERRORS, SqlValidationError, DIALECT_MAP, SIDE_EFFECTING_EXPRESSION_KINDS, POSTGRES_UNSAFE_FUNCTIONS, MYSQL_UNSAFE_FUNCTIONS, SNOWFLAKE_UNSAFE_FUNCTIONS;
+var OUTFILE_ERROR, ERRORS, SqlValidationError, DIALECT_MAP, SIDE_EFFECTING_EXPRESSION_KINDS, POSTGRES_UNSAFE_FUNCTIONS, MYSQL_UNSAFE_FUNCTIONS, SNOWFLAKE_UNSAFE_FUNCTIONS, DEFAULT_READ_ONLY_METADATA_STATEMENTS, READ_ONLY_METADATA_STATEMENT_OVERRIDES;
 var init_validate_sql = __esmMin((async () => {
 	await init_dist$1();
 	init_dist$4();
 	OUTFILE_ERROR = "SELECT INTO OUTFILE/DUMPFILE is not allowed";
 	ERRORS = {
 		cteSelectOnly: "CTEs must only contain SELECT statements",
-		nonReadOnlyQuery: (kind) => `Only SELECT or SHOW queries are allowed. Got: ${kind}`,
 		unsafeFunction: (name) => `Side-effecting SQL functions are not allowed: ${name}`,
 		locking: "SELECT locking clauses are not allowed",
 		selectInto: "SELECT INTO is not allowed"
@@ -128374,6 +128393,30 @@ var init_validate_sql = __esmMin((async () => {
 		"sys_exec"
 	]);
 	SNOWFLAKE_UNSAFE_FUNCTIONS = new Set(["system$wait"]);
+	DEFAULT_READ_ONLY_METADATA_STATEMENTS = [
+		{
+			allowOpaqueCommand: true,
+			displayName: "SHOW",
+			expressionKinds: ["show"],
+			firstKeywords: ["show"],
+			statementKind: "show"
+		},
+		{
+			allowOpaqueCommand: true,
+			displayName: "DESCRIBE",
+			expressionKinds: ["describe"],
+			firstKeywords: ["describe", "desc"],
+			statementKind: "describe"
+		},
+		{
+			allowOpaqueCommand: false,
+			displayName: "EXPLAIN",
+			expressionKinds: ["describe"],
+			firstKeywords: ["explain"],
+			statementKind: "explain"
+		}
+	];
+	READ_ONLY_METADATA_STATEMENT_OVERRIDES = {};
 }));
 //#endregion
 //#region packages/server/src/services/data-source-query/core/validation.ts