@push.rocks/smartdb 2.7.0 → 2.7.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartdb",
-  "version": "2.7.0",
+  "version": "2.7.1",
   "private": false,
   "description": "A MongoDB-compatible embedded database server with wire protocol support, backed by a high-performance Rust engine.",
   "exports": {

package/readme.md

@@ -248,6 +248,62 @@ const server = new SmartdbServer({
   persistPath: './data/snapshot.json',
   persistIntervalMs: 30000, // Save every 30s
 });
+
+// TLS transport for TCP mode
+const tlsServer = new SmartdbServer({
+  port: 27017,
+  tls: {
+    enabled: true,
+    certPath: './certs/server.pem',
+    keyPath: './certs/server.key',
+    // caPath: './certs/client-ca.pem',
+    // requireClientCert: true, // Enables mTLS client certificate checks
+  },
+});
+
+// SCRAM-SHA-256 authentication
+const secureServer = new SmartdbServer({
+  port: 27017,
+  auth: {
+    enabled: true,
+    usersPath: './data/smartdb-users.json', // Optional: persists derived SCRAM credentials
+    users: [
+      {
+        username: 'root',
+        password: 'change-me',
+        database: 'admin',
+        roles: ['root'],
+      },
+    ],
+  },
+});
+```
+
+When `auth.enabled` is true, protected commands require successful SCRAM-SHA-256 authentication through the official MongoDB driver:
+
+```typescript
+const client = new MongoClient('mongodb://root:change-me@127.0.0.1:27017/admin?authSource=admin', {
+  directConnection: true,
+});
+await client.connect();
+```
+
+TLS is available for TCP listeners. `getConnectionUri()` includes `?tls=true` when TLS is enabled; pass the trusted CA to the MongoDB driver with `tlsCAFile`, `ca`, or `secureContext`.
+
+Authentication verifies SCRAM credentials, denies unauthenticated commands, and enforces command-level built-in roles for supported operations.
+
+Supported built-in role names are `root`, `read`, `readWrite`, `dbAdmin`, `userAdmin`, `clusterMonitor`, plus `readAnyDatabase`, `readWriteAnyDatabase`, `dbAdminAnyDatabase`, and `userAdminAnyDatabase`. When `usersPath` is set, SmartDB persists SCRAM credential material atomically and does not store plaintext passwords.
+
+Basic user management commands are available for authenticated users with `root` or `userAdmin` privileges:
+
+```typescript
+await client.db('admin').command({
+  createUser: 'reader',
+  pwd: 'readpass',
+  roles: [{ role: 'read', db: 'myapp' }],
+});
+
+await client.db('admin').command({ usersInfo: 'reader' });
 ```
 
 #### Methods & Properties

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartdb',
-  version: '2.7.0',
+  version: '2.7.1',
   description: 'A MongoDB-compatible embedded database server with wire protocol support, backed by a high-performance Rust engine.'
 }

package/ts/ts_smartdb/index.ts

@@ -2,7 +2,12 @@
 
 // Export server (the main entry point for using SmartDB)
 export { SmartdbServer } from './server/SmartdbServer.js';
-export type { ISmartdbServerOptions } from './server/SmartdbServer.js';
+export type {
+  ISmartdbAuthOptions,
+  ISmartdbAuthUser,
+  ISmartdbServerOptions,
+  ISmartdbTlsOptions,
+} from './server/SmartdbServer.js';
 
 // Export bridge for advanced usage
 export { RustDbBridge } from './rust-db-bridge.js';

package/ts/ts_smartdb/rust-db-bridge.ts

@@ -117,6 +117,24 @@ interface ISmartDbRustConfig {
   storagePath?: string;
   persistPath?: string;
   persistIntervalMs?: number;
+  auth?: {
+    enabled?: boolean;
+    users?: Array<{
+      username: string;
+      password: string;
+      database?: string;
+      roles?: string[];
+    }>;
+    usersPath?: string;
+    scramIterations?: number;
+  };
+  tls?: {
+    enabled?: boolean;
+    certPath?: string;
+    keyPath?: string;
+    caPath?: string;
+    requireClientCert?: boolean;
+  };
 }
 
 /**

package/ts/ts_smartdb/server/SmartdbServer.ts

@@ -28,6 +28,32 @@ export interface ISmartdbServerOptions {
   persistPath?: string;
   /** Persistence interval in ms (default: 60000) */
   persistIntervalMs?: number;
+  /** Authentication configuration. Disabled by default. */
+  auth?: ISmartdbAuthOptions;
+  /** TLS transport configuration for TCP listeners. Disabled by default. */
+  tls?: ISmartdbTlsOptions;
+}
+
+export interface ISmartdbAuthOptions {
+  enabled?: boolean;
+  users?: ISmartdbAuthUser[];
+  usersPath?: string;
+  scramIterations?: number;
+}
+
+export interface ISmartdbAuthUser {
+  username: string;
+  password: string;
+  database?: string;
+  roles?: string[];
+}
+
+export interface ISmartdbTlsOptions {
+  enabled?: boolean;
+  certPath?: string;
+  keyPath?: string;
+  caPath?: string;
+  requireClientCert?: boolean;
 }
 
 /**
@@ -64,6 +90,8 @@ export class SmartdbServer {
       storagePath: options.storagePath ?? './data',
       persistPath: options.persistPath,
       persistIntervalMs: options.persistIntervalMs ?? 60000,
+      auth: options.auth,
+      tls: options.tls,
     };
     this.bridge = new RustDbBridge();
   }
@@ -106,6 +134,8 @@ export class SmartdbServer {
       storagePath: this.options.storagePath,
       persistPath: this.options.persistPath,
       persistIntervalMs: this.options.persistIntervalMs,
+      auth: this.options.auth,
+      tls: this.options.tls,
     });
 
     this.resolvedConnectionUri = result.connectionUri;
@@ -142,7 +172,8 @@ export class SmartdbServer {
       const encodedPath = encodeURIComponent(this.options.socketPath);
       return `mongodb://${encodedPath}`;
     }
-    return `mongodb://${this.options.host ?? '127.0.0.1'}:${this.options.port ?? 27017}`;
+    const baseUri = `mongodb://${this.options.host ?? '127.0.0.1'}:${this.options.port ?? 27017}`;
+    return this.options.tls?.enabled ? `${baseUri}/?tls=true` : baseUri;
   }
 
   /**